← All changes | src/rest-api/trait-use-post-id-parameter.php +62 -12 3.23.6 → 3.24.2 View file →

		@@ -9,8 +9,10 @@
9	9	declare( strict_types = 1 );
10	10
11	11	namespace Parsely\REST_API;
12	12
	13	+use WP_Error;
	14	+use WP_Post;
13	15	use WP_REST_Request;
14	16
15	17	/**
16	18	* Trait to register a REST route with a post ID parameter.
		@@ -49,26 +51,30 @@
49	51	),
50	52	)
51	53	);
52	54
53		- // Register the route.
54		- $this->register_rest_route( $route, $methods, $callback, $args );
	55	+ $this->register_rest_route(
	56	+ $route,
	57	+ $methods,
	58	+ $callback,
	59	+ $args,
	60	+ array( $this, 'can_access_request_post' )
	61	+ );
55	62	}
56	63
57	64	/**
58	65	* Validates the post ID parameter.
59	66	*
60		- * The callback sets the post object in the request object if the parameter is valid.
61		- *
62	67	* @since 3.16.0
63	68	* @since 3.17.0 Moved from the `Smart_Linking_Endpoint` class.
	69	+ * @since 3.24.2 Stopped storing the post object in the request object.
64	70	* @access private
65	71	*
66		- * @param string $param The parameter value.
67		- * @param WP_REST_Request $request The request object.
	72	+ * @param string $param The parameter value.
	73	+ * @param WP_REST_Request|null $request The request object.
68	74	* @return bool Whether the parameter is valid.
69	75	*/
70		- public function validate_post_id( string $param, WP_REST_Request $request ): bool {
	76	+ public function validate_post_id( string $param, ?WP_REST_Request $request = null ): bool { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter
71	77	if ( ! is_numeric( $param ) ) {
72	78	return false;
73	79	}
74	80
		@@ -77,13 +83,57 @@
77	83	if ( false === $param ) {
78	84	return false;
79	85	}
80	86
81		- // Validate if the post ID exists.
82		- $post = get_post( $param );
	87	+ return null !== get_post( $param );
	88	+ }
83	89
84		- // Set the post attribute in the request.
85		- $request->set_param( 'post', $post );
	90	+ /**
	91	+ * Returns the post that the request's post ID parameter refers to.
	92	+ *
	93	+ * @since 3.24.2
	94	+ *
	95	+ * @param WP_REST_Request $request The request object.
	96	+ * @return WP_Post|null The post object, or null if it doesn't exist.
	97	+ */
	98	+ protected function get_request_post( WP_REST_Request $request ): ?WP_Post {
	99	+ $post_id = (int) $request->get_param( 'post_id' );
86	100
87		- return null !== $post;
	101	+ return $post_id > 0 ? get_post( $post_id ) : null;
	102	+ }
	103	+
	104	+ /**
	105	+ * Checks whether the current user can access the post referenced by the
	106	+ * request, on top of the endpoint's own access checks.
	107	+ *
	108	+ * Parse.ly data for a post is available to users who can edit that post,
	109	+ * as the post itself might not be publicly available.
	110	+ *
	111	+ * @since 3.24.2
	112	+ * @access private
	113	+ *
	114	+ * @param WP_REST_Request $request The request object.
	115	+ * @return WP_Error|bool True if the request is allowed.
	116	+ */
	117	+ public function can_access_request_post( WP_REST_Request $request ) {
	118	+ $endpoint_access = $this->is_available_to_current_user( $request );
	119	+
	120	+ if ( true !== $endpoint_access ) {
	121	+ return $endpoint_access;
	122	+ }
	123	+
	124	+ $post_id = (int) $request->get_param( 'post_id' );
	125	+
	126	+ if ( $post_id > 0 && ! current_user_can( 'edit_post', $post_id ) ) {
	127	+ return new WP_Error(
	128	+ 'parsely_post_access_denied',
	129	+ __(
	130	+ 'Sorry, you are not allowed to access Parse.ly data for this post.',
	131	+ 'wp-parsely'
	132	+ ),
	133	+ array( 'status' => rest_authorization_required_code() )
	134	+ );
	135	+ }
	136	+
	137	+ return true;
88	138	}
89	139	}