templately / modules / display-conditions / REST / Conditions.php

Conditions.php in Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! 3.8.0, at modules/display-conditions/REST/Conditions.php

195 lines 5.6 KB

Raw Download Zip

1	<?php
2
3	namespace Templately\Modules\DisplayConditions\REST;
4
5	use Templately\Admin\Roles;
6	use Templately\API\API;
7	use Templately\Utils\Response\ErrorCode;
8	use Templately\Modules\DisplayConditions\Managers\ConditionManager;
9	use WP_REST_Request;
10	use WP_REST_Response;
11
12	class Conditions extends API {
13	/**
14	* @var ConditionManager
15	*/
16	private $conditions_manager;
17
18	public function permission_check( WP_REST_Request $request ) {
19	// Assigning display conditions is what actually activates a template
20	// site-wide, so it carries the same administrator-only bar as creating one.
21	// The old check resolved to `edit_posts`, which the Author role holds.
22	return Roles::can_manage_builder();
23	}
24
25	public function register_routes() {
26	$this->get( 'conditions', [ $this, 'get_conditions' ], [
27	'template_id' => [
28	'required' => false,
29	'validate_callback' => function ( $param ) {
30	return empty( $param ) \|\| is_numeric( $param );
31	}
32	]
33	] );
34
35	$this->get( 'check-conditions', [ $this, 'check' ], [
36	'template_id' => [
37	'required' => true,
38	'validate_callback' => function ( $param ) {
39	return is_numeric( $param );
40	}
41	]
42	] );
43
44	$this->post( 'save-conditions', [ $this, 'save' ], [
45	'template_id' => [
46	'required' => true,
47	'validate_callback' => function ( $param ) {
48	return is_numeric( $param );
49	}
50	],
51	'conditions' => [
52	'required' => true,
53	'validate_callback' => function ( $param ) {
54	return is_array( $param );
55	}
56	]
57	] );
58
59	$this->get( 'autocomplete-condition', [ $this, 'autocomplete' ], [
60	'payload' => [
61	'required' => true,
62	'validate_callback' => function ( $param ) {
63	return is_string( $param );
64	}
65	],
66	'query' => [
67	'required' => true,
68	'validate_callback' => function ( $param ) {
69	return is_array( $param ) && array_key_exists( 'query_type', $param );
70	}
71	]
72	] );
73
74	$this->conditions_manager = templately()->theme_builder::$conditions_manager;
75	}
76
77	public function get_conditions( WP_REST_Request $request ): WP_REST_Response {
78	$conditions = $this->conditions_manager->get_conditions_for_display( $request->get_param( 'template_id' ) );
79
80	return $this->success( $conditions );
81	}
82
83	public function check( WP_REST_Request $request ): WP_REST_Response {
84	return $this->success( [] );
85	}
86
87	public function save( WP_REST_Request $request ): WP_REST_Response {
88	$conditions = rest_sanitize_array( $request->get_param( 'conditions' ) );
89	$id = (int) $request->get_param( 'template_id' );
90
91
92	$this->conditions_manager->save_conditions( $id, $conditions );
93
94
95	return $this->success( __( 'Successfully saved.', 'templately' ) );
96	}
97
98	public function autocomplete( WP_REST_Request $request ): WP_REST_Response {
99	$query = $request->get_param( 'query' );
100	$type = $query['query_type'] ?? '';
101
102	$allowed_fields = [
103	'authors' => [ 'ID', 'user_nicename', 'display_name' ],
104	'posts' => [ 'ID', 'post_title', 'post_name' ],
105	'taxonomy' => [ 'term_id', 'slug', 'name' ],
106	];
107
108	// These three used to answer `success([])`, which is indistinguishable from
109	// "searched fine, found nothing". A rejected query and an empty result set
110	// are different facts, and the client could not tell them apart — so a
111	// malformed request looked like an empty condition list.
112	if ( empty( $type ) \|\| ! isset( $allowed_fields[ $type ] ) ) {
113	return $this->error(
114	ErrorCode::INVALID_REQUEST,
115	__( 'Unsupported query type.', 'templately' ),
116	'conditions_query',
117	400
118	);
119	}
120
121	$by_field = $query['field'] ?? '';
122
123	if ( empty( $by_field ) \|\| ! in_array( $by_field, $allowed_fields[ $type ], true ) ) {
124	return $this->error(
125	ErrorCode::INVALID_REQUEST,
126	__( 'Unsupported query field.', 'templately' ),
127	'conditions_query',
128	400
129	);
130	}
131
132	// A capability failure is a 403, not an empty list. Returning success here
133	// hid the refusal from the user AND from anyone auditing access denials.
134	if ( 'authors' === $type && ! current_user_can( 'list_users' ) ) {
135	return $this->error(
136	ErrorCode::AUTH_EXPIRED,
137	__( 'You are not allowed to list users.', 'templately' ),
138	'conditions_query',
139	403
140	);
141	}
142
143	$payload = sanitize_text_field( $request->get_param( 'payload' ) );
144	$args = [ 'search' => $payload ];
145	if ( is_numeric( $payload ) ) {
146	$args = [ 'post__in' => [ (int) $payload ] ];
147	}
148
149	if ( isset( $query['query'] ) && is_array( $query['query'] ) ) {
150	$safe_query_keys = [
151	'post_type', 'posts_per_page', 'number', 'orderby', 'order',
152	'taxonomy', 'parent', 'hide_empty',
153	];
154	$safe_query = array_intersect_key( $query['query'], array_flip( $safe_query_keys ) );
155	$args = wp_parse_args( $safe_query, $args );
156	}
157
158	$results = [];
159	$data = [];
160	$data_key = '';
161
162	switch ( $type ) {
163	case 'taxonomy':
164	$_default = [ 'hide_empty' => false ];
165	$data = get_terms( wp_parse_args( $args, $_default ) );
166	$data_key = 'name';
167	break;
168	case 'posts':
169	$args['s'] = $args['search'];
170	$args['post_status'] = 'publish';
171	$args['perm'] = 'readable';
172	$data = get_posts( $args );
173	$data_key = 'post_title';
174	break;
175	case 'authors':
176	$args['search_columns'] = [ 'user_nicename', 'user_login' ];
177	$args['search'] = "{$args['search']}";
178	$data = get_users( $args );
179
180	$data_key = 'display_name';
181	break;
182	}
183
184	if ( ! empty( $data ) && is_array( $data ) ) {
185	foreach ( $data as $item ) {
186	$results[] = [
187	'label' => $item->{$data_key},
188	'value' => $item->{$by_field}
189	];
190	}
191	}
192
193	return $this->success( $results );
194	}
195	}