| 1 |
<?php |
| 2 |
/** |
| 3 |
* Channel-ownership authorization helpers. |
| 4 |
* |
| 5 |
* Central place for deciding whether a given user is allowed to manage a |
| 6 |
* specific WpStream channel (start/stop it, or read its RTMP/WHIP publishing |
| 7 |
* credentials). Every state-changing or credential-returning channel handler |
| 8 |
* must gate on this so a streaming-capable user cannot control, or steal the |
| 9 |
* stream key of, a channel they do not own. This enforces the multi-broadcaster |
| 10 |
* isolation the product advertises (see TASK-01 / audit SEC-03, SEC-04). |
| 11 |
* |
| 12 |
* @package Wpstream |
| 13 |
* @subpackage Wpstream/includes/Helpers |
| 14 |
*/ |
| 15 |
|
| 16 |
// Block direct file access outside of WordPress. |
| 17 |
if ( ! defined( 'ABSPATH' ) ) { |
| 18 |
exit; |
| 19 |
} |
| 20 |
|
| 21 |
if ( ! function_exists( 'wpstream_can_manage_channel' ) ) { |
| 22 |
/** |
| 23 |
* Decide whether a user may manage a specific channel. |
| 24 |
* |
| 25 |
* The single rule: a site admin/editor (anyone who can edit posts they do |
| 26 |
* not author) may manage any channel; every other user may only manage a |
| 27 |
* channel they authored. The target must also be a real channel post — a |
| 28 |
* free `wpstream_product` or a paid WooCommerce `product`. |
| 29 |
* |
| 30 |
* "Manage" covers starting/stopping the channel and receiving its RTMP/WHIP |
| 31 |
* ingest credentials; the same ownership rule guards all of those actions, |
| 32 |
* so no per-action branching is needed here. |
| 33 |
* |
| 34 |
* Deliberately not filterable: this is the only IDOR guard on the |
| 35 |
* non-nonced start/stop/WHIP/RTMP-key endpoints. Widen who may broadcast |
| 36 |
* through wpstream_user_can_stream instead. |
| 37 |
* |
| 38 |
* @param int $user_id The acting user's ID (0/guest is always denied). |
| 39 |
* @param int $channel_id The channel post ID being acted upon. |
| 40 |
* @return bool True if the user may manage the channel, false otherwise. |
| 41 |
*/ |
| 42 |
function wpstream_can_manage_channel( $user_id, $channel_id ) { |
| 43 |
// Normalise inputs; a missing user or channel can never be authorized. |
| 44 |
$user_id = intval( $user_id ); |
| 45 |
$channel_id = intval( $channel_id ); |
| 46 |
if ( $user_id <= 0 || $channel_id <= 0 ) { |
| 47 |
return false; |
| 48 |
} |
| 49 |
|
| 50 |
// The target must exist and be a WpStream channel post type. |
| 51 |
$channel = get_post( $channel_id ); |
| 52 |
if ( ! $channel || ! in_array( $channel->post_type, array( 'wpstream_product', 'product' ), true ) ) { |
| 53 |
return false; |
| 54 |
} |
| 55 |
|
| 56 |
// Admins/editors (can edit posts they do not own) may manage any channel. |
| 57 |
if ( user_can( $user_id, 'edit_others_posts' ) ) { |
| 58 |
return true; |
| 59 |
} |
| 60 |
|
| 61 |
// Everyone else: only the author of the channel may manage it. |
| 62 |
return intval( $channel->post_author ) === $user_id; |
| 63 |
} |
| 64 |
} |
| 65 |
|
