← All changes
|
includes/api/class-settings-management-endpoint.php
+435
-33
1.25.0
→
2.7.0
View file →
| @@ -92,10 +92,15 @@ | ||
| 92 | 92 | 'social_media' => 'Social Media & Open Graph', |
| 93 | 93 | 'sitemap' => 'XML Sitemap Management', |
| 94 | 94 | 'integrations' => 'External Integrations', |
| 95 | 95 | 'analytics_integration' => 'Analytics Integration', |
| 96 | - 'seo_analytics' => 'SEO Analytics & Intelligence', | |
| 97 | - 'global_defaults' => 'Global Default Settings' | |
| 96 | + 'seo_analytics' => 'SEO Analytics & Intelligence' | |
| 97 | + // 'global_defaults' was listed here but is registered in no settings | |
| 98 | + // store and read by no client — the only mention in the codebase was | |
| 99 | + // this label. Every save against it reached the compound write with | |
| 100 | + // nothing to persist to and answered 500, so accepting the name only | |
| 101 | + // promised a category that could never be stored. It now falls through | |
| 102 | + // to the 400 invalid_category branch like any other unknown name (#371). | |
| 98 | 103 | ]; |
| 99 | 104 | |
| 100 | 105 | /** |
| 101 | 106 | * Constructor |
| @@ -116,9 +121,14 @@ | ||
| 116 | 121 | */ |
| 117 | 122 | private array $seo_manager_classes = [ |
| 118 | 123 | 'site_identity' => Site_Identity_Manager::class, |
| 119 | 124 | 'performance_monitoring' => Performance_Monitoring_Manager::class, |
| 120 | - 'ai_content_analyzer' => AI_Content_Analyzer::class, | |
| 125 | + // Keyed by the endpoint's own category name. It was 'ai_content_analyzer', | |
| 126 | + // which appears in no other registry, so the route rejected it with 400 | |
| 127 | + // invalid_category and this manager was never reachable — while the | |
| 128 | + // endpoint's actual category, 'content_analysis', had no manager and | |
| 129 | + // therefore nowhere to persist (#371). | |
| 130 | + 'content_analysis' => AI_Content_Analyzer::class, | |
| 121 | 131 | 'content_optimization' => Content_Optimization_Manager::class, |
| 122 | 132 | 'schema_management' => Schema_Management_System::class, |
| 123 | 133 | 'social_media' => Social_Meta_Manager::class, |
| 124 | 134 | 'sitemap' => Sitemap_Generator::class, |
| @@ -149,8 +159,39 @@ | ||
| 149 | 159 | return $this->seo_managers[$category]; |
| 150 | 160 | } |
| 151 | 161 | |
| 152 | 162 | /** |
| 163 | + * Read a category from whichever store actually owns it. | |
| 164 | + * | |
| 165 | + * The generic store returns `[]` for the eight SEO categories: it looks for | |
| 166 | + * rows whose key carries a `<category>_` prefix, and the rows carry no such | |
| 167 | + * prefix — `social_media` is stored as `social_meta`, `schema_management` as | |
| 168 | + * `schema_management_system`, and their keys are bare (`og_site_name`). So a | |
| 169 | + * direct `Settings_Manager::get_settings()` reports a configured site as | |
| 170 | + * having no settings at all. | |
| 171 | + * | |
| 172 | + * Writes never had the problem, because the write path already falls back to | |
| 173 | + * the owning manager. That asymmetry is what made this invisible from the UI | |
| 174 | + * and dangerous underneath it: the pre-reset rollback snapshotted `[]` and | |
| 175 | + * then defaults were written over live settings, so Reset could not be undone | |
| 176 | + * (#689). Every read goes through here now, so there is one place to be wrong. | |
| 177 | + * | |
| 178 | + * @since 2.7.0 | |
| 179 | + * | |
| 180 | + * @param string $category Category key. | |
| 181 | + * @param string $context_type Optional. Context type. Default 'site'. | |
| 182 | + * @param int|null $context_id Optional. Context ID. | |
| 183 | + * @return array The category's stored settings. | |
| 184 | + */ | |
| 185 | + private function read_category(string $category, string $context_type = 'site', ?int $context_id = null): array { | |
| 186 | + if ($this->has_seo_manager($category)) { | |
| 187 | + return (array) $this->get_seo_manager($category)->get_settings($context_type, $context_id); | |
| 188 | + } | |
| 189 | + | |
| 190 | + return (array) $this->settings_manager->get_settings($category, $context_type, $context_id); | |
| 191 | + } | |
| 192 | + | |
| 193 | + /** | |
| 153 | 194 | * Register API routes |
| 154 | 195 | * |
| 155 | 196 | * @since 1.0.0 |
| 156 | 197 | */ |
| @@ -247,9 +288,9 @@ | ||
| 247 | 288 | [ |
| 248 | 289 | [ |
| 249 | 290 | 'methods' => 'POST', |
| 250 | 291 | 'callback' => [$this, 'import_settings'], |
| 251 | - 'permission_callback' => [$this, 'check_manage_permissions'], | |
| 292 | + 'permission_callback' => [$this, 'check_admin_permissions'], | |
| 252 | 293 | 'args' => $this->get_import_args() |
| 253 | 294 | ] |
| 254 | 295 | ] |
| 255 | 296 | ); |
| @@ -288,9 +329,9 @@ | ||
| 288 | 329 | [ |
| 289 | 330 | [ |
| 290 | 331 | 'methods' => 'POST', |
| 291 | 332 | 'callback' => [$this, 'reset_settings'], |
| 292 | - 'permission_callback' => [$this, 'check_manage_permissions'], | |
| 333 | + 'permission_callback' => [$this, 'check_admin_permissions'], | |
| 293 | 334 | 'args' => $this->get_reset_args() |
| 294 | 335 | ] |
| 295 | 336 | ] |
| 296 | 337 | ); |
| @@ -302,9 +343,9 @@ | ||
| 302 | 343 | [ |
| 303 | 344 | [ |
| 304 | 345 | 'methods' => 'POST', |
| 305 | 346 | 'callback' => [$this, 'add_performance_indexes'], |
| 306 | - 'permission_callback' => [$this, 'check_manage_permissions'] | |
| 347 | + 'permission_callback' => [$this, 'check_admin_permissions'] | |
| 307 | 348 | ] |
| 308 | 349 | ] |
| 309 | 350 | ); |
| 310 | 351 | } |
| @@ -378,8 +419,96 @@ | ||
| 378 | 419 | return $settings; |
| 379 | 420 | } |
| 380 | 421 | |
| 381 | 422 | /** |
| 423 | + * Redact secrets from a single category's flat key => value map. | |
| 424 | + * | |
| 425 | + * Convenience wrapper so the single-category response shapes get the same | |
| 426 | + * treatment as the global map — no response path may return a cleartext | |
| 427 | + * secret. | |
| 428 | + * | |
| 429 | + * @param string $category Category slug. | |
| 430 | + * @param array $settings Flat key => value map for that category. | |
| 431 | + * @return array Redacted flat map. | |
| 432 | + */ | |
| 433 | + private function redact_category_settings(string $category, array $settings): array { | |
| 434 | + $redacted = $this->redact_sensitive_settings([$category => $settings]); | |
| 435 | + return $redacted[$category] ?? []; | |
| 436 | + } | |
| 437 | + | |
| 438 | + /** | |
| 439 | + * Drop masked secrets from an incoming write payload. | |
| 440 | + * | |
| 441 | + * Read responses return secrets masked ("••••abcd"). A client that GETs a | |
| 442 | + * settings map and POSTs it straight back would otherwise persist the mask | |
| 443 | + * over the real credential. Any sensitive key whose incoming value still | |
| 444 | + * carries the mask marker is removed so the stored value is left untouched; | |
| 445 | + * a genuinely new secret (no marker) writes through normally. | |
| 446 | + * | |
| 447 | + * @param array $settings Flat key => value map from the request. | |
| 448 | + * @return array Map with masked secret values removed. | |
| 449 | + */ | |
| 450 | + /** | |
| 451 | + * Drop setting keys the category does not define. | |
| 452 | + * | |
| 453 | + * The known set is whatever describes the category: the generic store's key | |
| 454 | + * list, and the dedicated manager's default settings when one owns it. | |
| 455 | + * Fails open — if neither store can describe the category there is nothing | |
| 456 | + * to check against, and silently dropping everything would be worse than | |
| 457 | + * storing an unknown key. | |
| 458 | + * | |
| 459 | + * @since 2.0.1 | |
| 460 | + * | |
| 461 | + * @param array $settings Incoming settings. | |
| 462 | + * @param string $category Settings category. | |
| 463 | + * @param string $context_type Context the write is scoped to. | |
| 464 | + * @return array Settings limited to recognised keys. | |
| 465 | + */ | |
| 466 | + private function filter_known_setting_keys(array $settings, string $category, string $context_type): array { | |
| 467 | + $known = []; | |
| 468 | + | |
| 469 | + // $this->setting_categories maps category => label; the key lists live | |
| 470 | + // in the generic store. | |
| 471 | + $known = array_merge($known, $this->settings_manager->get_category_keys($category)); | |
| 472 | + | |
| 473 | + if ($this->has_seo_manager($category)) { | |
| 474 | + $known = array_merge( | |
| 475 | + $known, | |
| 476 | + array_keys($this->get_seo_manager($category)->get_default_settings($context_type)) | |
| 477 | + ); | |
| 478 | + } | |
| 479 | + | |
| 480 | + /** | |
| 481 | + * Filter the setting keys a category accepts. | |
| 482 | + * | |
| 483 | + * @since 2.0.1 | |
| 484 | + * | |
| 485 | + * @param string[] $known Recognised setting keys. | |
| 486 | + * @param string $category Settings category. | |
| 487 | + * @param string $context_type Context the write is scoped to. | |
| 488 | + */ | |
| 489 | + $known = apply_filters('thinkrank_known_setting_keys', $known, $category, $context_type); | |
| 490 | + | |
| 491 | + if (empty($known)) { | |
| 492 | + return $settings; | |
| 493 | + } | |
| 494 | + | |
| 495 | + return array_intersect_key($settings, array_flip($known)); | |
| 496 | + } | |
| 497 | + | |
| 498 | + private function strip_masked_secrets(array $settings): array { | |
| 499 | + foreach ($settings as $key => $value) { | |
| 500 | + if (!in_array($key, self::SENSITIVE_SETTING_KEYS, true)) { | |
| 501 | + continue; | |
| 502 | + } | |
| 503 | + if (is_string($value) && strpos($value, '••••') !== false) { | |
| 504 | + unset($settings[$key]); | |
| 505 | + } | |
| 506 | + } | |
| 507 | + return $settings; | |
| 508 | + } | |
| 509 | + | |
| 510 | + /** | |
| 382 | 511 | * Get global settings across all categories |
| 383 | 512 | * |
| 384 | 513 | * @since 1.0.0 |
| 385 | 514 | * |
| @@ -398,10 +527,10 @@ | ||
| 398 | 527 | if (!isset($this->setting_categories[$category])) { |
| 399 | 528 | continue; |
| 400 | 529 | } |
| 401 | 530 | |
| 402 | - // Get settings for each category using Settings Manager | |
| 403 | - $category_settings = $this->settings_manager->get_settings($category); | |
| 531 | + // Get settings for each category from the store that owns it. | |
| 532 | + $category_settings = $this->read_category($category); | |
| 404 | 533 | $global_settings[$category] = $category_settings; |
| 405 | 534 | |
| 406 | 535 | // Get schema if requested |
| 407 | 536 | if ($include_schema && $this->has_seo_manager($category)) { |
| @@ -468,8 +597,11 @@ | ||
| 468 | 597 | "Settings for category '{$category}' must be provided as an object", |
| 469 | 598 | ['status' => 400] |
| 470 | 599 | ); |
| 471 | 600 | } |
| 601 | + | |
| 602 | + // Reads mask secrets; never persist a mask back over the real one. | |
| 603 | + $settings[$category] = $this->strip_masked_secrets($category_settings); | |
| 472 | 604 | } |
| 473 | 605 | |
| 474 | 606 | $validation_results = []; |
| 475 | 607 | $update_results = []; |
| @@ -534,9 +666,9 @@ | ||
| 534 | 666 | // Get updated settings |
| 535 | 667 | $updated_settings = []; |
| 536 | 668 | foreach (array_keys($settings) as $category) { |
| 537 | 669 | if (isset($this->setting_categories[$category])) { |
| 538 | - $updated_settings[$category] = $this->settings_manager->get_settings($category); | |
| 670 | + $updated_settings[$category] = $this->read_category($category); | |
| 539 | 671 | } |
| 540 | 672 | } |
| 541 | 673 | |
| 542 | 674 | return new WP_REST_Response([ |
| @@ -541,9 +673,9 @@ | ||
| 541 | 673 | |
| 542 | 674 | return new WP_REST_Response([ |
| 543 | 675 | 'success' => true, |
| 544 | 676 | 'data' => [ |
| 545 | - 'updated_settings' => $updated_settings, | |
| 677 | + 'updated_settings' => $this->redact_sensitive_settings($updated_settings), | |
| 546 | 678 | 'validation_results' => $validation_results, |
| 547 | 679 | 'update_results' => $update_results, |
| 548 | 680 | 'settings_version' => $this->get_settings_version() |
| 549 | 681 | ], |
| @@ -581,9 +713,9 @@ | ||
| 581 | 713 | ); |
| 582 | 714 | } |
| 583 | 715 | |
| 584 | 716 | // Get category settings |
| 585 | - $category_settings = $this->settings_manager->get_settings($category); | |
| 717 | + $category_settings = $this->read_category($category); | |
| 586 | 718 | |
| 587 | 719 | // Get schema if requested |
| 588 | 720 | $schema = []; |
| 589 | 721 | if ($include_schema && $this->has_seo_manager($category)) { |
| @@ -601,9 +733,9 @@ | ||
| 601 | 733 | |
| 602 | 734 | return new WP_REST_Response([ |
| 603 | 735 | 'success' => true, |
| 604 | 736 | 'data' => [ |
| 605 | - 'settings' => $category_settings, | |
| 737 | + 'settings' => $this->redact_category_settings($category, $category_settings), | |
| 606 | 738 | 'schema' => $schema, |
| 607 | 739 | 'metadata' => $metadata |
| 608 | 740 | ], |
| 609 | 741 | 'message' => "Settings for category '{$category}' retrieved successfully" |
| @@ -658,8 +790,41 @@ | ||
| 658 | 790 | ['status' => 400] |
| 659 | 791 | ); |
| 660 | 792 | } |
| 661 | 793 | |
| 794 | + // SECURITY: this route also accepts an object context and forwards it | |
| 795 | + // to the category's SEO manager, which upserts rows keyed by that ID. | |
| 796 | + // The `thinkrank_settings` capability authorises entry to the Settings | |
| 797 | + // section — it is not authorisation to edit every post on the site — so | |
| 798 | + // resolve and authorise the object before ANY write happens below (#367). | |
| 799 | + $context_type = $request->get_param('context_type') ?? 'site'; | |
| 800 | + $context_id = $request->get_param('context_id'); | |
| 801 | + $context_id = null === $context_id ? null : (int) $context_id; | |
| 802 | + | |
| 803 | + $context_error = $this->authorize_settings_context($context_type, $context_id); | |
| 804 | + if (is_wp_error($context_error)) { | |
| 805 | + return $context_error; | |
| 806 | + } | |
| 807 | + | |
| 808 | + // Reads mask secrets; never persist a mask back over the real one. | |
| 809 | + $settings = $this->strip_masked_secrets($settings); | |
| 810 | + | |
| 811 | + // Drop keys the category does not define. This route persisted any | |
| 812 | + // key it was handed — a probe key written through it is still | |
| 813 | + // readable in the settings table afterwards — which bloats the | |
| 814 | + // store and lets a client invent settings the plugin will never | |
| 815 | + // read (#395). Mirrors the same guard on the schema and | |
| 816 | + // social-media routes. | |
| 817 | + $settings = $this->filter_known_setting_keys($settings, $category, $context_type); | |
| 818 | + | |
| 819 | + if (empty($settings)) { | |
| 820 | + return new WP_Error( | |
| 821 | + 'invalid_settings', | |
| 822 | + "No recognized settings were provided for category: {$category}", | |
| 823 | + ['status' => 400] | |
| 824 | + ); | |
| 825 | + } | |
| 826 | + | |
| 662 | 827 | $validation_result = ['valid' => true]; |
| 663 | 828 | |
| 664 | 829 | // Validate settings if requested |
| 665 | 830 | if ($validate_before_update && $this->has_seo_manager($category)) { |
| @@ -677,24 +842,93 @@ | ||
| 677 | 842 | ); |
| 678 | 843 | } |
| 679 | 844 | } |
| 680 | 845 | |
| 681 | - // Update settings | |
| 682 | - $update_success = $this->settings_manager->update_settings($settings, $category); | |
| 846 | + // Update settings. The context must be forwarded: update_settings() | |
| 847 | + // defaults to the 'site' context, so a post-scoped request was also | |
| 848 | + // silently rewriting the site-wide defaults (#367). | |
| 849 | + $generic_update = $this->settings_manager->update_settings($settings, $category, $context_type, $context_id); | |
| 850 | + $manager_update = null; | |
| 683 | 851 | |
| 684 | - // Also update through specific SEO manager if available | |
| 852 | + // Also update through specific SEO manager if available. The context was | |
| 853 | + // resolved and authorised above. | |
| 685 | 854 | if ($this->has_seo_manager($category)) { |
| 686 | - $context_type = $request->get_param('context_type') ?? 'site'; | |
| 687 | - $context_id = $request->get_param('context_id') ?? null; | |
| 688 | 855 | $manager_update = $this->get_seo_manager($category)->save_settings($context_type, $context_id, $settings); |
| 689 | - $update_success = $update_success && $manager_update; | |
| 690 | 856 | } |
| 691 | 857 | |
| 858 | + // null from a store means "this category is not mine", not "the write | |
| 859 | + // failed" — the two registries use different category vocabularies, so | |
| 860 | + // most categories are owned by exactly one store (#371). Judge only the | |
| 861 | + // stores that actually attempted a write: the save succeeded if at least | |
| 862 | + // one store owned the category and none of the owners failed. ANDing the | |
| 863 | + // raw values reported 500 for every category the generic store does not | |
| 864 | + // know, while the dedicated manager's row had already committed. | |
| 865 | + $attempted = array_filter( | |
| 866 | + [$generic_update, $manager_update], | |
| 867 | + static fn($result) => null !== $result | |
| 868 | + ); | |
| 869 | + | |
| 870 | + $update_success = [] !== $attempted && !in_array(false, $attempted, true); | |
| 871 | + | |
| 692 | 872 | if (!$update_success) { |
| 873 | + // Name the settings that did not persist. The write is not | |
| 874 | + // transactional, so "failed" can mean some keys saved and others | |
| 875 | + // did not — without the list the UI can only show a generic | |
| 876 | + // error and the user has no idea what to re-enter (#300). | |
| 877 | + $failed_keys = $this->settings_manager->get_last_failed_keys(); | |
| 878 | + | |
| 879 | + // Report which store failed. Collapsing both writes into one boolean | |
| 880 | + // meant a committed manager row could be reported as a total failure, | |
| 881 | + // hiding a persisted change behind a 500 (#367). Only a literal false | |
| 882 | + // is a failure — null means the store does not own this category and | |
| 883 | + // never attempted a write, so it must not be named here (#371). | |
| 884 | + $stores_failed = []; | |
| 885 | + if (false === $generic_update) { | |
| 886 | + $stores_failed[] = 'settings'; | |
| 887 | + } | |
| 888 | + if (false === $manager_update) { | |
| 889 | + $stores_failed[] = 'category_manager'; | |
| 890 | + } | |
| 891 | + | |
| 892 | + // No store owns the category. That is a routing defect rather than a | |
| 893 | + // failed write, and it is worth distinguishing: the settings were | |
| 894 | + // never persisted anywhere, so reporting it as a plain write failure | |
| 895 | + // would send the user back to re-enter values that have nowhere to go. | |
| 896 | + if ([] === $attempted) { | |
| 897 | + return new WP_Error( | |
| 898 | + 'category_not_persistable', | |
| 899 | + sprintf( | |
| 900 | + 'No settings store is registered for category %s, so nothing was saved.', | |
| 901 | + $category | |
| 902 | + ), | |
| 903 | + [ | |
| 904 | + 'status' => 500, | |
| 905 | + 'failed_keys' => $failed_keys, | |
| 906 | + 'stores_failed' => $stores_failed, | |
| 907 | + 'partial_write' => false, | |
| 908 | + ] | |
| 909 | + ); | |
| 910 | + } | |
| 911 | + | |
| 693 | 912 | return new WP_Error( |
| 694 | 913 | 'update_failed', |
| 695 | - "Failed to update settings for category: {$category}", | |
| 696 | - ['status' => 500] | |
| 914 | + empty($failed_keys) | |
| 915 | + ? "Failed to update settings for category: {$category}" | |
| 916 | + : sprintf( | |
| 917 | + 'Failed to save %s in category %s. Other settings in this request were saved.', | |
| 918 | + implode(', ', $failed_keys), | |
| 919 | + $category | |
| 920 | + ), | |
| 921 | + [ | |
| 922 | + 'status' => 500, | |
| 923 | + 'failed_keys' => $failed_keys, | |
| 924 | + 'stores_failed' => $stores_failed, | |
| 925 | + // True when more than one store attempted the write and they | |
| 926 | + // disagreed, so the client knows the request was not a clean | |
| 927 | + // no-op. Stores that did not own the category are excluded. | |
| 928 | + 'partial_write' => in_array(true, $attempted, true) | |
| 929 | + && in_array(false, $attempted, true), | |
| 930 | + ] | |
| 697 | 931 | ); |
| 698 | 932 | } |
| 699 | 933 | |
| 700 | 934 | // Clear analytics cache when GSC/GA settings change so fresh data is fetched |
| @@ -709,16 +943,26 @@ | ||
| 709 | 943 | |
| 710 | 944 | // Update category metadata |
| 711 | 945 | $this->update_category_metadata($category); |
| 712 | 946 | |
| 713 | - // Get updated settings | |
| 714 | - $updated_settings = $this->settings_manager->get_settings($category); | |
| 947 | + // Get updated settings. Read them back from whichever store actually | |
| 948 | + // owns the category: the generic store returns [] for the categories it | |
| 949 | + // does not know, which would report a successful save as zero settings | |
| 950 | + // and hand the UI an empty form to render (#371). | |
| 951 | + // | |
| 952 | + // Which store *accepted the write* is the wrong question to ask here, | |
| 953 | + // and `sitemap` is the case that proves it: the generic store claims | |
| 954 | + // that write (update_settings() returns true, not null) and then reads | |
| 955 | + // the category back as [], so keying off $generic_update sent the one | |
| 956 | + // read path that had been fixed straight back into the empty store. | |
| 957 | + // Ownership is a property of the category, not of the last write (#689). | |
| 958 | + $updated_settings = $this->read_category($category, $context_type, $context_id); | |
| 715 | 959 | |
| 716 | 960 | return new WP_REST_Response([ |
| 717 | 961 | 'success' => true, |
| 718 | 962 | 'data' => [ |
| 719 | 963 | 'category' => $category, |
| 720 | - 'updated_settings' => $updated_settings, | |
| 964 | + 'updated_settings' => $this->redact_category_settings($category, $updated_settings), | |
| 721 | 965 | 'validation_result' => $validation_result, |
| 722 | 966 | 'settings_count' => count($updated_settings) |
| 723 | 967 | ], |
| 724 | 968 | 'message' => "Settings for category '{$category}' updated successfully" |
| @@ -889,9 +1133,9 @@ | ||
| 889 | 1133 | if (!isset($this->setting_categories[$category])) { |
| 890 | 1134 | continue; |
| 891 | 1135 | } |
| 892 | 1136 | |
| 893 | - $export_data[$category] = $this->settings_manager->get_settings($category); | |
| 1137 | + $export_data[$category] = $this->read_category($category); | |
| 894 | 1138 | } |
| 895 | 1139 | |
| 896 | 1140 | // Never let secrets (API keys, OAuth tokens) leave the site in an |
| 897 | 1141 | // export file — strip them entirely. |
| @@ -1027,9 +1271,9 @@ | ||
| 1027 | 1271 | } |
| 1028 | 1272 | |
| 1029 | 1273 | try { |
| 1030 | 1274 | // Check if settings exist and handle overwrite |
| 1031 | - $existing_settings = $this->settings_manager->get_settings($category); | |
| 1275 | + $existing_settings = $this->read_category($category); | |
| 1032 | 1276 | |
| 1033 | 1277 | if (!empty($existing_settings) && !$overwrite_existing) { |
| 1034 | 1278 | $import_results[$category] = [ |
| 1035 | 1279 | 'success' => false, |
| @@ -1102,9 +1346,9 @@ | ||
| 1102 | 1346 | // Create backup data |
| 1103 | 1347 | $backup_data = []; |
| 1104 | 1348 | foreach ($categories as $category) { |
| 1105 | 1349 | if (isset($this->setting_categories[$category])) { |
| 1106 | - $backup_data[$category] = $this->settings_manager->get_settings($category); | |
| 1350 | + $backup_data[$category] = $this->read_category($category); | |
| 1107 | 1351 | } |
| 1108 | 1352 | } |
| 1109 | 1353 | |
| 1110 | 1354 | // Create backup metadata |
| @@ -1355,9 +1599,9 @@ | ||
| 1355 | 1599 | * |
| 1356 | 1600 | * @param WP_REST_Request $request Request object |
| 1357 | 1601 | * @return WP_REST_Response|WP_Error Response object |
| 1358 | 1602 | */ |
| 1359 | - public function add_performance_indexes(WP_REST_Request $request): WP_REST_Response|WP_Error { | |
| 1603 | + public function add_performance_indexes(WP_REST_Request $request) { | |
| 1360 | 1604 | try { |
| 1361 | 1605 | // Import the Database_Schema class |
| 1362 | 1606 | if (!class_exists('ThinkRank\\Database\\Database_Schema')) { |
| 1363 | 1607 | require_once THINKRANK_PLUGIN_DIR . 'includes/database/class-database-schema.php'; |
| @@ -1405,15 +1649,49 @@ | ||
| 1405 | 1649 | * @since 1.0.0 |
| 1406 | 1650 | * |
| 1407 | 1651 | * @return bool Permission status |
| 1408 | 1652 | */ |
| 1409 | - public function check_read_permissions(): bool { | |
| 1653 | + public function check_read_permissions(WP_REST_Request $request): bool { | |
| 1410 | 1654 | // Plugin SEO/AI config is not subscriber-visible — require the same |
| 1411 | - // management capability as the write routes. | |
| 1412 | - return \ThinkRank\Core\Capability_Manager::current_user_can('thinkrank_settings'); | |
| 1655 | + // management capability as the write routes, resolved per category so a | |
| 1656 | + // role granted one section can reach that section and no other (#573). | |
| 1657 | + return \ThinkRank\Core\Capability_Manager::current_user_can( | |
| 1658 | + $this->capability_for_request($request) | |
| 1659 | + ); | |
| 1413 | 1660 | } |
| 1414 | 1661 | |
| 1415 | 1662 | /** |
| 1663 | + * The capability a settings-management request requires. | |
| 1664 | + * | |
| 1665 | + * Category routes belong to the section owning the category; every other | |
| 1666 | + * route on this controller is plugin-wide configuration and stays on | |
| 1667 | + * `thinkrank_settings`. The gate in Role_Manager::gate_rest() reaches the | |
| 1668 | + * same answer through Capability_Manager::capability_for_route() — both are | |
| 1669 | + * kept so neither layer alone is load-bearing. | |
| 1670 | + * | |
| 1671 | + * @since 2.1.3 | |
| 1672 | + * | |
| 1673 | + * @param WP_REST_Request $request Request. | |
| 1674 | + * @return string | |
| 1675 | + */ | |
| 1676 | + private function capability_for_request(WP_REST_Request $request): string { | |
| 1677 | + // URL params only. get_param() searches the JSON body, the POST body | |
| 1678 | + // and the query string ahead of the route path, so on the routes that | |
| 1679 | + // declare no {category} — /global, /validate, /schema, /export, | |
| 1680 | + // /backup, /restore — it read pure caller input and let a request | |
| 1681 | + // nominate the capability it would be checked against (#582). Reading | |
| 1682 | + // the path is also what Role_Manager::gate_rest() does, so the two | |
| 1683 | + // layers now agree and the claim above is true again. | |
| 1684 | + $category = $request->get_url_params()['category'] ?? null; | |
| 1685 | + | |
| 1686 | + if (!is_string($category) || '' === $category) { | |
| 1687 | + return 'thinkrank_settings'; | |
| 1688 | + } | |
| 1689 | + | |
| 1690 | + return \ThinkRank\Core\Capability_Manager::capability_for_settings_category($category); | |
| 1691 | + } | |
| 1692 | + | |
| 1693 | + /** | |
| 1416 | 1694 | * Check permissions for managing settings |
| 1417 | 1695 | * |
| 1418 | 1696 | * @since 1.0.0 |
| 1419 | 1697 | * |
| @@ -1418,13 +1696,31 @@ | ||
| 1418 | 1696 | * @since 1.0.0 |
| 1419 | 1697 | * |
| 1420 | 1698 | * @return bool Permission status |
| 1421 | 1699 | */ |
| 1422 | - public function check_manage_permissions(): bool { | |
| 1423 | - return \ThinkRank\Core\Capability_Manager::current_user_can('thinkrank_settings'); | |
| 1700 | + public function check_manage_permissions(WP_REST_Request $request): bool { | |
| 1701 | + return \ThinkRank\Core\Capability_Manager::current_user_can( | |
| 1702 | + $this->capability_for_request($request) | |
| 1703 | + ); | |
| 1424 | 1704 | } |
| 1425 | 1705 | |
| 1426 | 1706 | /** |
| 1707 | + * Check permissions for administrator-only settings operations. | |
| 1708 | + * | |
| 1709 | + * The Role Manager can delegate `thinkrank_settings` to non-admin roles so | |
| 1710 | + * they can manage the plugin's SEO configuration. Schema-level (DDL) and | |
| 1711 | + * destructive whole-configuration operations — performance indexes, reset, | |
| 1712 | + * import — are a different altitude and stay with site administrators. | |
| 1713 | + * | |
| 1714 | + * @since 1.29.0 | |
| 1715 | + * | |
| 1716 | + * @return bool Permission status | |
| 1717 | + */ | |
| 1718 | + public function check_admin_permissions(): bool { | |
| 1719 | + return current_user_can('manage_options'); | |
| 1720 | + } | |
| 1721 | + | |
| 1722 | + /** | |
| 1427 | 1723 | * Helper methods |
| 1428 | 1724 | */ |
| 1429 | 1725 | |
| 1430 | 1726 | /** |
| @@ -1616,8 +1912,9 @@ | ||
| 1616 | 1912 | uasort($backup_index, static function ($a, $b) { |
| 1617 | 1913 | return strcmp((string) ($a['created_at'] ?? ''), (string) ($b['created_at'] ?? '')); |
| 1618 | 1914 | }); |
| 1619 | 1915 | |
| 1916 | + // phpcs:ignore Squiz.PHP.DisallowSizeFunctionsInLoops.Found -- the loop shrinks $backup_index, so the count has to be re-read. | |
| 1620 | 1917 | while (count($backup_index) > $max_backups) { |
| 1621 | 1918 | $oldest_id = array_key_first($backup_index); |
| 1622 | 1919 | unset($backup_index[$oldest_id]); |
| 1623 | 1920 | delete_option("thinkrank_backup_{$oldest_id}"); |
| @@ -1683,13 +1980,100 @@ | ||
| 1683 | 1980 | 'required' => false, |
| 1684 | 1981 | 'type' => 'boolean', |
| 1685 | 1982 | 'default' => true, |
| 1686 | 1983 | 'description' => 'Whether to validate settings before updating' |
| 1984 | + ], | |
| 1985 | + // Declared so the REST schema validates/normalises them. They were read | |
| 1986 | + // by the handler while undeclared, which skipped validation entirely (#367). | |
| 1987 | + 'context_type' => [ | |
| 1988 | + 'required' => false, | |
| 1989 | + 'type' => 'string', | |
| 1990 | + 'enum' => ['site', 'post', 'page', 'product'], | |
| 1991 | + 'default' => 'site', | |
| 1992 | + 'description' => 'Object context these settings apply to' | |
| 1993 | + ], | |
| 1994 | + 'context_id' => [ | |
| 1995 | + 'required' => false, | |
| 1996 | + 'type' => 'integer', | |
| 1997 | + 'minimum' => 1, | |
| 1998 | + 'description' => 'Object ID when context_type is not "site"' | |
| 1687 | 1999 | ] |
| 1688 | 2000 | ]; |
| 1689 | 2001 | } |
| 1690 | 2002 | |
| 1691 | 2003 | /** |
| 2004 | + * Authorise the object context a category settings write targets. | |
| 2005 | + * | |
| 2006 | + * The Settings section capability is delegatable, so a non-administrator can | |
| 2007 | + * reach this controller. Writing settings for a specific post is an edit of | |
| 2008 | + * that post and must be authorised as one — mirroring the per-object check the | |
| 2009 | + * social-media write route performs (#277, #367). | |
| 2010 | + * | |
| 2011 | + * @since 1.32.0 | |
| 2012 | + * | |
| 2013 | + * @param string $context_type Requested context type. | |
| 2014 | + * @param int|null $context_id Requested object ID. | |
| 2015 | + * @return true|WP_Error True when the write is allowed, WP_Error otherwise. | |
| 2016 | + */ | |
| 2017 | + private function authorize_settings_context(string $context_type, ?int $context_id) { | |
| 2018 | + if ('site' === $context_type) { | |
| 2019 | + return true; | |
| 2020 | + } | |
| 2021 | + | |
| 2022 | + if (!in_array($context_type, ['post', 'page', 'product'], true)) { | |
| 2023 | + return new WP_Error( | |
| 2024 | + 'invalid_context', | |
| 2025 | + 'Invalid context type provided', | |
| 2026 | + ['status' => 400] | |
| 2027 | + ); | |
| 2028 | + } | |
| 2029 | + | |
| 2030 | + if (!$context_id || $context_id <= 0) { | |
| 2031 | + return new WP_Error( | |
| 2032 | + 'invalid_context', | |
| 2033 | + 'A valid context_id is required for non-site contexts', | |
| 2034 | + ['status' => 400] | |
| 2035 | + ); | |
| 2036 | + } | |
| 2037 | + | |
| 2038 | + $post = get_post($context_id); | |
| 2039 | + | |
| 2040 | + if (!$post || 'revision' === $post->post_type) { | |
| 2041 | + return new WP_Error( | |
| 2042 | + 'invalid_context', | |
| 2043 | + 'The requested content could not be found', | |
| 2044 | + ['status' => 404] | |
| 2045 | + ); | |
| 2046 | + } | |
| 2047 | + | |
| 2048 | + // The declared context must match the one the front-end read path derives | |
| 2049 | + // from the real post type, otherwise `page`/`product` can alias an arbitrary | |
| 2050 | + // object and the row is written where nothing will ever read it. Mirrors | |
| 2051 | + // Seo_Manager::get_context_type() — custom post types fall back to 'post'. | |
| 2052 | + $expected_context = in_array($post->post_type, ['post', 'page', 'product'], true) | |
| 2053 | + ? $post->post_type | |
| 2054 | + : 'post'; | |
| 2055 | + | |
| 2056 | + if ($context_type !== $expected_context) { | |
| 2057 | + return new WP_Error( | |
| 2058 | + 'invalid_context', | |
| 2059 | + 'The context type does not match the requested content.', | |
| 2060 | + ['status' => 400] | |
| 2061 | + ); | |
| 2062 | + } | |
| 2063 | + | |
| 2064 | + if (!current_user_can('edit_post', $context_id)) { | |
| 2065 | + return new WP_Error( | |
| 2066 | + 'rest_forbidden', | |
| 2067 | + 'You are not allowed to edit settings for this content.', | |
| 2068 | + ['status' => 403] | |
| 2069 | + ); | |
| 2070 | + } | |
| 2071 | + | |
| 2072 | + return true; | |
| 2073 | + } | |
| 2074 | + | |
| 2075 | + /** | |
| 1692 | 2076 | * Get arguments for validation endpoint |
| 1693 | 2077 | * |
| 1694 | 2078 | * @since 1.0.0 |
| 1695 | 2079 | * |
| @@ -1888,9 +2272,27 @@ | ||
| 1888 | 2272 | private function create_settings_snapshot(array $categories, string $label): string { |
| 1889 | 2273 | $backup_data = []; |
| 1890 | 2274 | foreach ($categories as $category) { |
| 1891 | 2275 | if (isset($this->setting_categories[$category])) { |
| 1892 | - $backup_data[$category] = $this->settings_manager->get_settings($category); | |
| 2276 | + $backup_data[$category] = $this->read_category($category); | |
| 2277 | + } | |
| 2278 | + } | |
| 2279 | + | |
| 2280 | + // A snapshot that captured nothing for a category that does hold settings | |
| 2281 | + // is worse than no snapshot: reset checks only that an id came back, so an | |
| 2282 | + // empty one is accepted as a rollback point and the defaults go over live | |
| 2283 | + // data that can no longer be recovered. That is exactly what #689 was. | |
| 2284 | + // | |
| 2285 | + // Ask the owning manager directly rather than trusting read_category(), | |
| 2286 | + // so this stays a real check if a future edit sends a read back to the | |
| 2287 | + // wrong store instead of quietly agreeing with it. | |
| 2288 | + foreach ($backup_data as $category => $captured) { | |
| 2289 | + if (!empty($captured) || !$this->has_seo_manager($category)) { | |
| 2290 | + continue; | |
| 2291 | + } | |
| 2292 | + | |
| 2293 | + if (!empty((array) $this->get_seo_manager($category)->get_settings('site', null))) { | |
| 2294 | + return ''; | |
| 1893 | 2295 | } |
| 1894 | 2296 | } |
| 1895 | 2297 | |
| 1896 | 2298 | $backup_metadata = [ |