← All changes | src/rest-api/content-helper/class-endpoint-smart-linking.php +87 -22 3.24.1 → 3.24.3 View file →

		@@ -196,8 +196,10 @@
196	196	array(
197	197	'urls' => array(
198	198	'required' => true,
199	199	'type' => 'array',
	200	+ 'items' => array( 'type' => 'string' ),
	201	+ 'maxItems' => 500,
200	202	'description' => __( 'The URLs to get meta information for.', 'wp-parsely' ),
201	203	),
202	204	)
203	205	);
		@@ -265,26 +267,30 @@
265	267	*
266	268	* Gets the smart links for a post.
267	269	*
268	270	* @since 3.16.0
	271	+ * @since 3.24.2 Inbound links of non-visible source posts are omitted.
269	272	*
270	273	* @param WP_REST_Request $request The request object.
271		- * @return WP_REST_Response The response object.
	274	+ * @return WP_REST_Response|WP_Error The response object.
272	275	*/
273		- public function get_smart_links( WP_REST_Request $request ): WP_REST_Response {
274		- /**
275		- * The post object.
276		- *
277		- * @var WP_Post $post
278		- */
279		- $post = $request->get_param( 'post' );
	276	+ public function get_smart_links( WP_REST_Request $request ) {
	277	+ $post = $this->get_request_post( $request );
280	278
	279	+ if ( ! $post instanceof WP_Post ) {
	280	+ return new WP_Error(
	281	+ 'invalid_post',
	282	+ __( 'Invalid post.', 'wp-parsely' ),
	283	+ array( 'status' => 404 )
	284	+ );
	285	+ }
	286	+
281	287	$outbound_links = Smart_Link::get_outbound_smart_links( $post->ID, Smart_Link_Status::APPLIED );
282	288	$inbound_links = Smart_Link::get_inbound_smart_links( $post->ID, Smart_Link_Status::APPLIED );
283	289
284	290	$response = array(
285	291	'outbound' => $this->serialize_smart_links( $outbound_links ),
286		- 'inbound' => $this->serialize_smart_links( $inbound_links ),
	292	+ 'inbound' => $this->serialize_visible_inbound_links( $inbound_links ),
287	293	);
288	294
289	295	return new WP_REST_Response( array( 'data' => $response ), 200 );
290	296	}
		@@ -440,18 +446,21 @@
440	446	*
441	447	* @since 3.16.0
442	448	*
443	449	* @param WP_REST_Request $request The request object.
444		- * @return WP_REST_Response The response object.
	450	+ * @return WP_REST_Response|WP_Error The response object.
445	451	*/
446		- public function set_smart_links( WP_REST_Request $request ): WP_REST_Response {
447		- /**
448		- * The post object.
449		- *
450		- * @var WP_Post $post
451		- */
452		- $post = $request->get_param( 'post' );
	452	+ public function set_smart_links( WP_REST_Request $request ) {
	453	+ $post = $this->get_request_post( $request );
453	454
	455	+ if ( ! $post instanceof WP_Post ) {
	456	+ return new WP_Error(
	457	+ 'invalid_post',
	458	+ __( 'Invalid post.', 'wp-parsely' ),
	459	+ array( 'status' => 404 )
	460	+ );
	461	+ }
	462	+
454	463	/**
455	464	* Array of Smart Link models provided in the request.
456	465	*
457	466	* @var Smart_Link[] $smart_links
		@@ -559,15 +568,20 @@
559	568	*
560	569	* The callback sets the smart link object in the request object if the parameters are valid.
561	570	*
562	571	* @since 3.16.0
	572	+ * @since 3.24.2 Rejects non-arrays.
563	573	* @access private
564	574	*
565		- * @param array<mixed> $params The parameters.
	575	+ * @param mixed $params The raw parameter value, as validation runs before type checks.
566	576	* @param WP_REST_Request $request The request object.
567	577	* @return bool Whether the parameters are valid.
568	578	*/
569		- public function validate_smart_link_params( array $params, WP_REST_Request $request ): bool {
	579	+ public function validate_smart_link_params( $params, WP_REST_Request $request ): bool {
	580	+ if ( ! is_array( $params ) ) {
	581	+ return false;
	582	+ }
	583	+
570	584	$required_params = array( 'uid', 'href', 'title', 'text', 'offset' );
571	585
572	586	foreach ( $required_params as $param ) {
573	587	if ( ! isset( $params[ $param ] ) ) {
		@@ -596,8 +610,12 @@
596	610	if ( ! is_string( $params['href']['raw'] ) ) {
597	611	return false;
598	612	}
599	613
	614	+ if ( ! Smart_Link::is_valid_href( $params['href']['raw'] ) ) {
	615	+ return false;
	616	+ }
	617	+
600	618	// Try to get the smart link from the UID.
601	619	$smart_link = Smart_Link::get_smart_link( $params['uid'], intval( $post_id ) );
602	620	if ( $smart_link->exists() ) {
603	621	// Update the smart link with the new data.
		@@ -631,15 +649,20 @@
631	649	*
632	650	* The callback sets the smart links object in the request object if the parameters are valid.
633	651	*
634	652	* @since 3.16.0
	653	+ * @since 3.24.2 Rejects non-arrays.
635	654	* @access private
636	655	*
637		- * @param array<array<mixed>> $param The parameter value.
638		- * @param WP_REST_Request $request The request object.
	656	+ * @param mixed $param The raw parameter value, as validation runs before type checks.
	657	+ * @param WP_REST_Request $request The request object.
639	658	* @return bool Whether the parameter is valid.
640	659	*/
641		- public function validate_multiple_smart_links( array $param, WP_REST_Request $request ): bool {
	660	+ public function validate_multiple_smart_links( $param, WP_REST_Request $request ): bool {
	661	+ if ( ! is_array( $param ) ) {
	662	+ return false;
	663	+ }
	664	+
642	665	$smart_links = array();
643	666
644	667	foreach ( $param as $link ) {
645	668	if ( $this->validate_smart_link_params( $link, $request ) ) {
		@@ -652,8 +675,50 @@
652	675	$request->set_param( 'smart_link', null );
653	676	$request->set_param( 'smart_links', $smart_links );
654	677
655	678	return true;
	679	+ }
	680	+
	681	+ /**
	682	+ * Serializes inbound Smart Links, dropping the ones whose source post the
	683	+ * current user cannot see.
	684	+ *
	685	+ * @since 3.24.2
	686	+ *
	687	+ * @param Smart_Link[] $links The inbound Smart Links to serialize.
	688	+ * @return array<mixed> The serialized Smart Links.
	689	+ */
	690	+ private function serialize_visible_inbound_links( array $links ): array {
	691	+ $serialized = array();
	692	+
	693	+ foreach ( $links as $link ) {
	694	+ $source_post_id = $link->source_post_id;
	695	+ $can_edit = current_user_can( 'edit_post', $source_post_id );
	696	+
	697	+ if ( ! $can_edit && ! is_post_publicly_viewable( $source_post_id ) ) {
	698	+ continue;
	699	+ }
	700	+
	701	+ $data = json_decode( $link->serialize(), true );
	702	+
	703	+ if ( ! is_array( $data ) ) {
	704	+ continue;
	705	+ }
	706	+
	707	+ // WordPress withholds a protected post's content; the anchor text
	708	+ // and the paragraph are both drawn from it.
	709	+ if ( ! $can_edit && post_password_required( $source_post_id ) ) {
	710	+ $data['text'] = '';
	711	+
	712	+ if ( isset( $data['post_data'] ) && is_array( $data['post_data'] ) ) {
	713	+ $data['post_data']['paragraph'] = '';
	714	+ }
	715	+ }
	716	+
	717	+ $serialized[] = $data;
	718	+ }
	719	+
	720	+ return $serialized;
656	721	}
657	722
658	723	/**
659	724	* Serializes an array of Smart Links.