| @@ -16,15 +16,12 @@ | ||
| 16 | 16 | use UserAccessManager\UserGroup\UserGroupTypeException; |
| 17 | 17 | use UserAccessManager\Util\Util; |
| 18 | 18 | use UserAccessManager\Wrapper\Php; |
| 19 | 19 | use UserAccessManager\Wrapper\Wordpress; |
| 20 | -use WeakMap; | |
| 21 | 20 | use WP_Comment; |
| 22 | 21 | use WP_Hook; |
| 23 | 22 | use WP_Post; |
| 24 | 23 | use WP_Query; |
| 25 | -use WP_REST_Request; | |
| 26 | -use WP_REST_Response; | |
| 27 | 24 | |
| 28 | 25 | class PostController extends ContentController |
| 29 | 26 | { |
| 30 | 27 | private array $wordpressFilters = []; |
| @@ -29,10 +26,8 @@ | ||
| 29 | 26 | { |
| 30 | 27 | private array $wordpressFilters = []; |
| 31 | 28 | private stdClass|array|null $cachedCounts = []; |
| 32 | 29 | |
| 33 | - private WeakMap $posts; | |
| 34 | - | |
| 35 | 30 | public function __construct( |
| 36 | 31 | Php $php, |
| 37 | 32 | Wordpress $wordpress, |
| 38 | 33 | WordpressConfig $wordpressConfig, |
| @@ -54,10 +49,8 @@ | ||
| 54 | 49 | $userHandler, |
| 55 | 50 | $userGroupHandler, |
| 56 | 51 | $accessHandler |
| 57 | 52 | ); |
| 58 | - | |
| 59 | - $this->posts = new WeakMap(); | |
| 60 | 53 | } |
| 61 | 54 | |
| 62 | 55 | public function getWordpressFilters(): array |
| 63 | 56 | { |
| @@ -69,13 +62,8 @@ | ||
| 69 | 62 | return isset($wpQuery->query_vars['suppress_filters']) === true |
| 70 | 63 | && $wpQuery->query_vars['suppress_filters'] === true; |
| 71 | 64 | } |
| 72 | 65 | |
| 73 | - private function addExcludedPosts(mixed $postsNotIn, array $excludedPosts): array | |
| 74 | - { | |
| 75 | - return array_unique(array_merge((array) $postsNotIn, $excludedPosts)); | |
| 76 | - } | |
| 77 | - | |
| 78 | 66 | /** |
| 79 | 67 | * @throws UserGroupTypeException |
| 80 | 68 | */ |
| 81 | 69 | public function parseQuery(WP_Query $wpQuery): void |
| @@ -83,11 +71,13 @@ | ||
| 83 | 71 | if ($this->filtersSuppressed($wpQuery) === true) { |
| 84 | 72 | $excludedPosts = $this->accessHandler->getExcludedPosts(); |
| 85 | 73 | |
| 86 | 74 | if ($excludedPosts !== []) { |
| 87 | - $wpQuery->query_vars['post__not_in'] = $this->addExcludedPosts( | |
| 88 | - $wpQuery->query_vars['post__not_in'] ?? [], | |
| 89 | - $excludedPosts | |
| 75 | + $postsNotIn = (isset($wpQuery->query_vars['post__not_in']) === true) ? | |
| 76 | + $wpQuery->query_vars['post__not_in'] : []; | |
| 77 | + | |
| 78 | + $wpQuery->query_vars['post__not_in'] = array_unique( | |
| 79 | + array_merge($postsNotIn, $excludedPosts) | |
| 90 | 80 | ); |
| 91 | 81 | } |
| 92 | 82 | } |
| 93 | 83 | } |
| @@ -176,15 +166,15 @@ | ||
| 176 | 166 | |
| 177 | 167 | /** |
| 178 | 168 | * @throws UserGroupTypeException |
| 179 | 169 | */ |
| 180 | - private function processPost(WP_Post $post): WP_Post|bool | |
| 170 | + private function processPost(WP_Post $post): ?WP_Post | |
| 181 | 171 | { |
| 182 | 172 | $post->post_title .= $this->adminOutput($post->post_type, $post->ID); |
| 183 | 173 | |
| 184 | 174 | if ($this->accessHandler->checkObjectAccess($post->post_type, $post->ID) === false) { |
| 185 | 175 | if ($this->removePostFromList($post->post_type) === true) { |
| 186 | - return false; | |
| 176 | + return null; | |
| 187 | 177 | } |
| 188 | 178 | |
| 189 | 179 | $post->post_content = $this->processPostContent($post); |
| 190 | 180 | |
| @@ -202,17 +192,8 @@ | ||
| 202 | 192 | |
| 203 | 193 | /** |
| 204 | 194 | * @throws UserGroupTypeException |
| 205 | 195 | */ |
| 206 | - private function getProcessedPost(WP_Post $post): ?WP_Post | |
| 207 | - { | |
| 208 | - $post = $this->posts[$post] ??= $this->processPost($post); | |
| 209 | - return $post === false ? null : $post; | |
| 210 | - } | |
| 211 | - | |
| 212 | - /** | |
| 213 | - * @throws UserGroupTypeException | |
| 214 | - */ | |
| 215 | 196 | private function filterRawPosts(array $rawPosts): array |
| 216 | 197 | { |
| 217 | 198 | $filteredPosts = []; |
| 218 | 199 | |
| @@ -219,9 +200,9 @@ | ||
| 219 | 200 | foreach ($rawPosts as $rawPost) { |
| 220 | 201 | $post = $this->getPost($rawPost); |
| 221 | 202 | |
| 222 | 203 | if ($post !== false) { |
| 223 | - $post = $this->getProcessedPost($post); | |
| 204 | + $post = $this->processPost($post); | |
| 224 | 205 | |
| 225 | 206 | if ($post !== null) { |
| 226 | 207 | $filteredPosts[] = $post; |
| 227 | 208 | } |
| @@ -255,97 +236,13 @@ | ||
| 255 | 236 | { |
| 256 | 237 | return $this->filterRawPosts($rawPages); |
| 257 | 238 | } |
| 258 | 239 | |
| 259 | - private function isSingleObjectRestRequest(mixed $request, WP_Post $post): bool | |
| 260 | - { | |
| 261 | - return $request instanceof WP_REST_Request | |
| 262 | - && $request->get_param('id') !== null | |
| 263 | - && (int) $request->get_param('id') === (int) $post->ID; | |
| 264 | - } | |
| 265 | - | |
| 266 | - private function setRestField(array &$data, string $field, string $value): void | |
| 267 | - { | |
| 268 | - if (array_key_exists($field, $data) === false) { | |
| 269 | - return; | |
| 270 | - } | |
| 271 | - | |
| 272 | - if (is_array($data[$field]) === true) { | |
| 273 | - if (array_key_exists('rendered', $data[$field]) === true) { | |
| 274 | - $data[$field]['rendered'] = $value; | |
| 275 | - } | |
| 276 | - | |
| 277 | - if (array_key_exists('raw', $data[$field]) === true) { | |
| 278 | - $data[$field]['raw'] = $value; | |
| 279 | - } | |
| 280 | - | |
| 281 | - if (array_key_exists('protected', $data[$field]) === true) { | |
| 282 | - $data[$field]['protected'] = false; | |
| 283 | - } | |
| 284 | - } else { | |
| 285 | - $data[$field] = $value; | |
| 286 | - } | |
| 287 | - } | |
| 288 | - | |
| 289 | 240 | /** |
| 290 | - * The_posts / posts_where_paged never run for REST single-item requests, | |
| 291 | - * which resolve through get_post() directly, so access is enforced here too. | |
| 292 | - * | |
| 293 | 241 | * @throws UserGroupTypeException |
| 294 | 242 | */ |
| 295 | - public function restrictRestResponse(mixed $response, mixed $post = null, mixed $request = null): mixed | |
| 243 | + public function getAttachedFile(string $file, int|string $attachmentId): bool|string | |
| 296 | 244 | { |
| 297 | - if (($response instanceof WP_REST_Response) === false | |
| 298 | - || ($post instanceof WP_Post) === false | |
| 299 | - || $this->accessHandler->checkObjectAccess($post->post_type, $post->ID) === true | |
| 300 | - ) { | |
| 301 | - return $response; | |
| 302 | - } | |
| 303 | - | |
| 304 | - if ($this->removePostFromList($post->post_type) === true | |
| 305 | - && $this->isSingleObjectRestRequest($request, $post) === true | |
| 306 | - ) { | |
| 307 | - return $this->wordpress->getWpError( | |
| 308 | - 'uam_rest_access_denied', | |
| 309 | - TXT_UAM_REST_ACCESS_DENIED, | |
| 310 | - ['status' => $this->wordpress->isUserLoggedIn() === true ? 403 : 401] | |
| 311 | - ); | |
| 312 | - } | |
| 313 | - | |
| 314 | - $restrictedContent = $this->processPostContent($post); | |
| 315 | - $data = (array) $response->get_data(); | |
| 316 | - | |
| 317 | - $this->setRestField($data, 'content', $restrictedContent); | |
| 318 | - $this->setRestField($data, 'excerpt', $restrictedContent); | |
| 319 | - | |
| 320 | - if ($this->mainConfig->hidePostTypeTitle($post->post_type) === true) { | |
| 321 | - $this->setRestField($data, 'title', $this->mainConfig->getPostTypeTitle($post->post_type)); | |
| 322 | - } | |
| 323 | - | |
| 324 | - $response->set_data($data); | |
| 325 | - | |
| 326 | - return $response; | |
| 327 | - } | |
| 328 | - | |
| 329 | - /** | |
| 330 | - * @throws UserGroupTypeException | |
| 331 | - */ | |
| 332 | - public function excludeRestrictedPostsFromRestQuery(array $queryArgs): array | |
| 333 | - { | |
| 334 | - $excludedPosts = $this->accessHandler->getExcludedPosts(); | |
| 335 | - | |
| 336 | - if ($excludedPosts !== []) { | |
| 337 | - $queryArgs['post__not_in'] = $this->addExcludedPosts($queryArgs['post__not_in'] ?? [], $excludedPosts); | |
| 338 | - } | |
| 339 | - | |
| 340 | - return $queryArgs; | |
| 341 | - } | |
| 342 | - | |
| 343 | - /** | |
| 344 | - * @throws UserGroupTypeException | |
| 345 | - */ | |
| 346 | - public function getAttachedFile(string $file, int|string|null $attachmentId): bool|string | |
| 347 | - { | |
| 348 | 245 | $isImage = (bool) preg_match('/(?i)\.(jpg|jpeg|jpe|png|gif)$/', $file); |
| 349 | 246 | |
| 350 | 247 | if ($isImage === false && $this->mainConfig->lockFile() === true) { |
| 351 | 248 | $hasAccess = $this->accessHandler->checkObjectAccess(ObjectHandler::ATTACHMENT_OBJECT_TYPE, $attachmentId); |
| @@ -362,9 +259,9 @@ | ||
| 362 | 259 | { |
| 363 | 260 | $excludedPosts = $this->accessHandler->getExcludedPosts(); |
| 364 | 261 | |
| 365 | 262 | if ($excludedPosts !== []) { |
| 366 | - $excludedPostsStr = implode(', ', array_map('intval', $excludedPosts)); | |
| 263 | + $excludedPostsStr = implode(', ', $excludedPosts); | |
| 367 | 264 | $query .= " AND $table.ID NOT IN ($excludedPostsStr) "; |
| 368 | 265 | } |
| 369 | 266 | |
| 370 | 267 | return $query; |
| @@ -387,13 +284,13 @@ | ||
| 387 | 284 | } |
| 388 | 285 | |
| 389 | 286 | private function getPostCountQuery(array $excludedPosts, string $type, string $perm): string |
| 390 | 287 | { |
| 391 | - $excludedPosts = implode(', ', array_map('intval', $excludedPosts)); | |
| 392 | - $query = "SELECT post_status, COUNT(*) AS num_posts | |
| 393 | - FROM {$this->database->getPostsTable()} | |
| 288 | + $excludedPosts = implode('\', \'', $excludedPosts); | |
| 289 | + $query = "SELECT post_status, COUNT(*) AS num_posts | |
| 290 | + FROM {$this->database->getPostsTable()} | |
| 394 | 291 | WHERE post_type = %s |
| 395 | - AND ID NOT IN ($excludedPosts)"; | |
| 292 | + AND ID NOT IN ('$excludedPosts')"; | |
| 396 | 293 | |
| 397 | 294 | if ('readable' === $perm |
| 398 | 295 | && $this->wordpress->isUserLoggedIn() === true |
| 399 | 296 | && $this->wordpress->currentUserCan( |
| @@ -476,9 +373,9 @@ | ||
| 476 | 373 | |
| 477 | 374 | /** |
| 478 | 375 | * @throws UserGroupTypeException |
| 479 | 376 | */ |
| 480 | - public function showEditLink(?string $link, int|string|null $postId): string | |
| 377 | + public function showEditLink(?string $link, int|string $postId): string | |
| 481 | 378 | { |
| 482 | 379 | if ($this->mainConfig->hideEditLinkOnNoAccess() === true |
| 483 | 380 | && $this->accessHandler->checkObjectAccess(ObjectHandler::GENERAL_POST_OBJECT_TYPE, $postId, true) === false |
| 484 | 381 | ) { |
