← All changes | classes/RestAPI.php +47 -87 trunk → 2.7.0 View file →

		@@ -115,71 +115,11 @@
115	115	$this->author_obj = new REST_Author();
116	116	$this->rating_obj = new REST_Rating();
117	117
118	118	add_action( 'rest_api_init', array( $this, 'init_routes' ) );
119		- add_filter( 'rest_request_before_callbacks', array( $this, 'check_permission' ), 10, 3 );
120	119	}
121	120
122	121	/**
123		- * Check permission before dispatching REST request.
124		- *
125		- * @todo will remove and prevent by capability where needed.
126		- *
127		- * @since 4.0.1
128		- *
129		- * @param mixed $response response.
130		- * @param mixed $handler handler.
131		- * @param \WP_REST_Request $request request.
132		- *
133		- * @return mixed|\WP_Error
134		- */
135		- public function check_permission( $response, $handler, $request ) {
136		- $id = absint( $request['id'] );
137		- $method = $request->get_method();
138		- $write_methods = array( 'POST', 'PUT', 'PATCH', 'DELETE' );
139		- $is_write = in_array( $method, $write_methods, true );
140		-
141		- if ( ! $id ) {
142		- return $response;
143		- }
144		-
145		- $post = get_post( $id );
146		-
147		- if ( ! $post ) {
148		- return $response;
149		- }
150		-
151		- $post_types = array(
152		- tutor()->course_post_type,
153		- tutor()->bundle_post_type,
154		- );
155		-
156		- if ( ! in_array( $post->post_type, $post_types, true ) ) {
157		- return $response;
158		- }
159		-
160		- // Prevent write actions which are only allowed for author.
161		- if ( $is_write && ! current_user_can( 'edit_post', $id ) ) {
162		- return new \WP_Error(
163		- 'rest_forbidden',
164		- tutor_utils()->error_message(),
165		- array( 'status' => rest_authorization_required_code() )
166		- );
167		- }
168		-
169		- // Prevent access to non-publish posts, only author can access.
170		- if ( 'publish' !== $post->post_status && ! current_user_can( 'edit_post', $id ) ) {
171		- return new \WP_Error(
172		- 'rest_forbidden',
173		- tutor_utils()->error_message(),
174		- array( 'status' => rest_authorization_required_code() )
175		- );
176		- }
177		-
178		- return $response;
179		- }
180		-
181		- /**
182	122	* Class loading
183	123	*
184	124	* @since 1.5.0
185	125	*
		@@ -225,12 +165,53 @@
225	165	'permission_callback' => array( RestAuth::class, 'process_api_request' ),
226	166	)
227	167	);
228	168
	169	+ // Courses by terms cat and tag.
	170	+ register_rest_route(
	171	+ $this->namespace,
	172	+ '/course-by-terms',
	173	+ array(
	174	+ 'methods' => 'POST',
	175	+ 'callback' => array(
	176	+ $this->course_obj,
	177	+ 'course_by_terms',
	178	+ ),
	179	+ 'permission_callback' => array( RestAuth::class, 'process_api_request' ),
	180	+ )
	181	+ );
	182	+
	183	+ // Courses by terms cat and tag.
	184	+ register_rest_route(
	185	+ $this->namespace,
	186	+ '/course-sorting-by-price',
	187	+ array(
	188	+ 'methods' => 'GET',
	189	+ 'callback' => array(
	190	+ $this->course_obj,
	191	+ 'course_sort_by_price',
	192	+ ),
	193	+ 'args' => array(
	194	+ 'order' => array(
	195	+ 'required' => true,
	196	+ 'type' => 'string',
	197	+ 'validate_callback' => function ( $order ) {
	198	+ return $this->validate_order( $order );
	199	+ },
	200	+ ),
	201	+ 'page' => array(
	202	+ 'required' => false,
	203	+ 'type' => 'number',
	204	+ ),
	205	+ ),
	206	+ 'permission_callback' => array( RestAuth::class, 'process_api_request' ),
	207	+ )
	208	+ );
	209	+
229	210	// Course details.
230	211	register_rest_route(
231	212	$this->namespace,
232		- '/courses/(?P<id>\d+)',
	213	+ '/course-detail/(?P<id>\d+)',
233	214	array(
234	215	'methods' => 'GET',
235	216	'callback' => array(
236	217	$this->course_obj,
		@@ -249,9 +230,9 @@
249	230
250	231	// Course topic.
251	232	register_rest_route(
252	233	$this->namespace,
253		- '/topics',
	234	+ '/course-topic/(?P<id>\d+)',
254	235	array(
255	236	'methods' => 'GET',
256	237	'callback' => array(
257	238	$this->topic_obj,
		@@ -257,9 +238,9 @@
257	238	$this->topic_obj,
258	239	'course_topic',
259	240	),
260	241	'args' => array(
261		- 'course_id' => array(
	242	+ 'id' => array(
262	243	'validate_callback' => function ( $param ) {
263	244	return is_numeric( $param );
264	245	},
265	246	),
		@@ -270,9 +251,9 @@
270	251
271	252	// Lesson by topic.
272	253	register_rest_route(
273	254	$this->namespace,
274		- '/lessons',
	255	+ '/lesson/(?P<id>\d+)',
275	256	array(
276	257	'methods' => 'GET',
277	258	'callback' => array(
278	259	$this->lesson_obj,
		@@ -278,9 +259,9 @@
278	259	$this->lesson_obj,
279	260	'topic_lesson',
280	261	),
281	262	'args' => array(
282		- 'topic_id' => array(
	263	+ 'id' => array(
283	264	'validate_callback' => function ( $param ) {
284	265	return is_numeric( $param );
285	266	},
286	267	),
		@@ -312,35 +293,14 @@
312	293
313	294	// Quiz by topic id.
314	295	register_rest_route(
315	296	$this->namespace,
316		- '/quizzes',
	297	+ '/quiz/(?P<id>\d+)',
317	298	array(
318	299	'methods' => 'GET',
319	300	'callback' => array(
320	301	$this->quiz_obj,
321	302	'quiz_with_settings',
322		- ),
323		- 'args' => array(
324		- 'topic_id' => array(
325		- 'validate_callback' => function ( $param ) {
326		- return is_numeric( $param );
327		- },
328		- ),
329		- ),
330		- 'permission_callback' => array( RestAuth::class, 'process_api_request' ),
331		- )
332		- );
333		-
334		- // Quiz by quiz id.
335		- register_rest_route(
336		- $this->namespace,
337		- '/quizzes/(?P<id>\d+)',
338		- array(
339		- 'methods' => 'GET',
340		- 'callback' => array(
341		- $this->quiz_obj,
342		- 'get_quiz',
343	303	),
344	304	'args' => array(
345	305	'id' => array(
346	306	'validate_callback' => function ( $param ) {