← All changes | core/settings/api-settings.php +68 -50 trunk → 1.0.49 View file →

		@@ -5,10 +5,8 @@
5	5	* @package Timetics
6	6	*/
7	7	namespace Timetics\Core\Settings;
8	8
9		-defined( 'ABSPATH' ) || exit;
10		-
11	9	use Timetics\Base\Api;
12	10	use Timetics\Core\Admin\Hooks;
13	11	use Timetics\Utils\Singleton;
14	12
		@@ -40,10 +38,8 @@
40	38	[
41	39	'methods' => \WP_REST_Server::READABLE,
42	40	'callback' => [$this, 'get_settings'],
43	41	'permission_callback' => function () {
44		- // The public booking app needs a small, explicitly safe
45		- // settings payload. get_settings() filters it by role.
46	42	return true;
47	43	},
48	44	],
49	45	[
		@@ -87,15 +83,19 @@
87	83	* @return JSON
88	84	*/
89	85	public function get_settings() {
90	86	$settings = apply_filters( 'timetics_settings', timetics_get_settings() );
91		-
92		- // The booking and staff interfaces need non-sensitive display and scheduling
93		- // settings. Never send credentials or webhook URLs to non-administrators.
94		- if ( ! current_user_can( 'manage_options' ) ) {
95		- $settings = $this->get_staff_safe_settings( $settings );
	87	+ $role = !current_user_can( 'manage_timetics' );
	88	+ //only run for non user capabilities
	89	+ if ( $role ) {
	90	+ $exclude_settings = $this->exclude_settings_for_customer();
	91	+ foreach($settings as $key => $setting){
	92	+ if( in_array( $key, $exclude_settings )){
	93	+ unset( $settings[$key] );
	94	+ }
	95	+ }
96	96	}
97		-
	97	+
98	98	$data = [
99	99	'status_code' => 200,
100	100	'success' => 1,
101	101	'message' => esc_html__( 'Get all settings', 'timetics' ),
		@@ -105,47 +105,8 @@
105	105	return rest_ensure_response( $settings );
106	106	}
107	107
108	108	/**
109		- * Return only settings that staff need to use the admin interface.
110		- *
111		- * This is deliberately an allow-list. New settings remain private until they
112		- * have been reviewed and explicitly added here.
113		- *
114		- * @param array $settings Plugin settings.
115		- *
116		- * @return array
117		- */
118		- private function get_staff_safe_settings( $settings ) {
119		- $safe_keys = [
120		- 'availability',
121		- 'apple_calendar',
122		- 'blocked_days',
123		- 'busyness_category',
124		- 'calendar_locale',
125		- 'currency',
126		- 'custom_fields',
127		- 'default_booking_status',
128		- 'guest_enabled',
129		- 'guest_limit',
130		- 'google_calendar',
131		- 'locale_timezone',
132		- 'paypal_status',
133		- 'primary_color',
134		- 'remainder_time',
135		- 'secondary_color',
136		- 'slot_interval',
137		- 'stripe_status',
138		- 'outlook_calendar',
139		- 'wc_integration',
140		- 'wc_checkout_url',
141		- 'zoom_connection_type',
142		- ];
143		-
144		- return array_intersect_key( (array) $settings, array_flip( $safe_keys ) );
145		- }
146		-
147		- /**
148	109	* Update settings
149	110	*
150	111	* @param WP_Rest_Request $request
151	112	*
		@@ -169,9 +130,9 @@
169	130	$custom_domain_data = [
170	131	'custom_domain_url' => $options['custom_domain_url'],
171	132	'network_slug' => $options['network_slug'],
172	133	];
173		- do_action('timetics_custom_domain_data', $custom_domain_data);
	134	+ do_action('custom_domain_data', $custom_domain_data);
174	135	}
175	136
176	137
177	138	if ( !empty($options['schedule']) && $options['schedule'] && apply_filters('timetics/staff/member/availability', false)) {
		@@ -282,5 +243,62 @@
282	243
283	244	return rest_ensure_response( $response );
284	245	}
285	246
	247	+ public function exclude_settings_for_customer() {
	248	+ $allowed_keys = [
	249	+ "booking_created_customer_email_from",
	250	+ "booking_created_customer_email_title",
	251	+ "booking_created_customer_email_body",
	252	+ "booking_created_host_email_from",
	253	+ "booking_created_host_email_title",
	254	+ "booking_created_host_email_body",
	255	+ "booking_canceled_customer_email_from",
	256	+ "booking_canceled_customer_email_title",
	257	+ "booking_canceled_customer_email_body",
	258	+ "booking_canceled_host_email_from",
	259	+ "booking_canceled_host_email_title",
	260	+ "booking_canceled_host_email_body",
	261	+ "booking_rescheduled_customer_email_from",
	262	+ "booking_rescheduled_customer_email_title",
	263	+ "booking_rescheduled_customer_email_body",
	264	+ "booking_rescheduled_host_email_from",
	265	+ "booking_rescheduled_host_email_title",
	266	+ "booking_rescheduled_host_email_body",
	267	+ "booking_reminder_customer_email_from",
	268	+ "booking_reminder_customer_email_title",
	269	+ "booking_reminder_customer_email_body",
	270	+ "booking_reminder_host_email_from",
	271	+ "booking_reminder_host_email_title",
	272	+ "booking_reminder_host_email_body",
	273	+ "google_auth_redirect_uri",
	274	+ "google_app_client_id",
	275	+ "google_app_client_secret",
	276	+ "zoom_client_id",
	277	+ "zoom_client_secret",
	278	+ "zoom_auth_redirect_uri",
	279	+ "fluentcrm_webhook",
	280	+ "zapier_webhook",
	281	+ "twillo_account_id",
	282	+ "twillo_token",
	283	+ "twillo_phone_number",
	284	+ "booking_created_customer",
	285	+ "booking_created_host",
	286	+ "booking_canceled_customer",
	287	+ "booking_canceled_host",
	288	+ "booking_rescheduled_customer",
	289	+ "booking_rescheduled_host",
	290	+ "booking_reminder_customer",
	291	+ "booking_reminder_host",
	292	+ "stripe_pub_key",
	293	+ "stripe_secret_key",
	294	+ "paypal_client_id",
	295	+ "paypal_client_secret",
	296	+ "outlook_app_client_id",
	297	+ "outlook_app_client_secret",
	298	+ "outlook_auth_redirect_uri",
	299	+ ];
	300	+
	301	+
	302	+ return $allowed_keys;
	303	+ }
286	304	}