WordPress.org
Get WordPress

Plugin Directory

Changeset 2966789


Ignore:
Timestamp:
09/14/2023 12:26:14 AM (3 years ago)
Author:
dmchale
Message:

v1.8

Location:
disable-json-api
Files:
27 added
2 deleted
7 edited

Legend:

Unmodified
Added
Removed

  • disable-json-api/trunk/admin.php

    r2574374 r2966789  
    88    </p>
    99
    10     <hr />
     10    <hr/>
    1111
    1212    <div id="select-container">
    1313        <?php esc_html_e( "Rules for", "disable-json-api" ); ?>: <select name="role" id="dra-role">
    1414            <option value="none"><?php esc_html_e( "Unauthenticated Users", "disable-json-api" ); ?></option>
    15             <?php
    16             $role = ( isset( $_GET['role'] ) ) ? $_GET['role'] : 'none';
    17             wp_dropdown_roles( $role );
    18             ?>
     15            <?php
     16            $role = ( isset( $_GET['role'] ) ) ? $_GET['role'] : 'none';
     17            wp_dropdown_roles( $role );
     18            ?>
    1919        </select>
    2020    </div>
    2121
    22     <hr />
     22    <hr/>
    2323
    2424    <form method="post" action="" id="DRA_form">
    25         <?php wp_nonce_field( 'DRA_admin_nonce' ); ?>
     25        <?php wp_nonce_field( 'DRA_admin_nonce' ); ?>
    2626        <input type="hidden" name="role" value="<?php echo esc_attr( $role ); ?>">
    2727
    2828        <div id="default-allow-container">
    29             <?php DRA_Admin::display_role_default_allow( $role ); ?>
     29            <?php DRA_Admin::display_role_default_allow( $role ); ?>
    3030        </div>
    3131
    32         <hr />
     32        <hr/>
    3333
    3434        <div id="route-container">
    35             <?php DRA_Admin::display_route_checkboxes( $role ); ?>
    36             <hr />
     35            <?php DRA_Admin::display_route_checkboxes( $role ); ?>
     36            <hr/>
    3737        </div>
    3838

  • disable-json-api/trunk/classes/admin.php

    r2474673 r2966789  
    11<?php
     2
    23class DRA_Admin {
    34
    … …  
    89     */
    910    static function display_route_checkboxes( $role = 'none' ) {
    10         $all_namespaces     = DRA_Helpers::get_all_rest_namespaces();
    11         $all_routes         = DRA_Helpers::get_all_rest_routes();
    12         $allowed_routes     = DRA_Helpers::get_allowed_routes( $role );
     11        $all_namespaces = DRA_Helpers::get_all_rest_namespaces();
     12        $all_routes     = DRA_Helpers::get_all_rest_routes();
     13        $allowed_routes = DRA_Helpers::get_allowed_routes( $role );
    1314
    1415        $loopCounter       = 0;
    … …  
    6465     */
    6566    static function display_role_default_allow( $role ) {
    66         $default_allow_true_checked = '';
     67        $default_allow_true_checked  = '';
    6768        $default_allow_false_checked = '';
    6869
    … …  
    7677        /* translators: name of user role */
    7778        echo sprintf( '<h2>%s</h2>', sprintf( esc_html__( 'Manage Rules for %s Users', 'disable-json-api' ), DRA_Helpers::get_role_name( $role ) ) );
    78         ?>
    79         <p style="font-style:italic;">
    80             <?php
    81             echo esc_html__( 'NOTE: New routes may be added in the future by plugins, themes, or WordPress itself.', 'disable-json-api' );
    82             echo '<br />';
    83             echo esc_html__( 'If you choose to manage access for a user role, you will have to come back and add permissions for any new routes later.', 'disable-json-api' );
    84             ?>
     79        ?>
     80        <p style="font-style:italic;">
     81            <?php
     82            echo esc_html__( 'NOTE: New routes may be added in the future by plugins, themes, or WordPress itself.', 'disable-json-api' );
     83            echo '<br />';
     84            echo esc_html__( 'If you choose to manage access for a user role, you will have to come back and add permissions for any new routes later.', 'disable-json-api' );
     85            ?>
    8586        </p>
    86         <label><input type="radio" name="default_allow" value="0" <?php echo $default_allow_false_checked; ?>>&nbsp;<?php echo esc_html__( 'Manage REST API Access', 'disable-json-api' ); ?></label>
    87         &nbsp;&nbsp;&nbsp;
    88         <label><input type="radio" name="default_allow" value="1" <?php echo $default_allow_true_checked; ?>>&nbsp;<?php echo esc_html__( 'Allow Full REST API Access', 'disable-json-api' ); ?></label>
     87        <label><input type="radio" name="default_allow" value="0" <?php echo $default_allow_false_checked; ?>>&nbsp;<?php echo esc_html__( 'Manage REST API Access', 'disable-json-api' ); ?></label>
     88        &nbsp;&nbsp;&nbsp;
     89        <label><input type="radio" name="default_allow" value="1" <?php echo $default_allow_true_checked; ?>>&nbsp;<?php echo esc_html__( 'Allow Full REST API Access', 'disable-json-api' ); ?></label>
    8990        <?php
    9091    }

  • disable-json-api/trunk/classes/disable-rest-api.php

    r2574374 r2966789  
    11<?php
     2
    23/**
    34 * Disable_REST_API class
    … …  
    3031
    3132        // Do logic for upgrading to 1.6 from versions less than 1.6
    32         add_action( 'init', array( &$this, 'option_check' ) );
     33        add_action( 'wp_loaded', array( &$this, 'option_check' ) );
    3334
    3435        // Set up admin page for plugin settings
    … …  
    7374     */
    7475    private function get_current_route() {
    75         $rest_route = $GLOBALS['wp']->query_vars['rest_route'];
     76        $rest_route = isset( $GLOBALS['wp']->query_vars['rest_route'] ) ?
     77            $GLOBALS['wp']->query_vars['rest_route'] :
     78            '';
    7679
    7780        return ( empty( $rest_route ) || '/' == $rest_route ) ?
    … …  
    9093    private function is_route_allowed( $currentRoute ) {
    9194
    92         $current_options = get_option( 'disable_rest_api_options', array() );
     95        $current_options    = get_option( 'disable_rest_api_options', array() );
    9396        $current_user_roles = $this->get_current_user_roles();
    9497
    … …  
    97100
    98101            // If we have a definition for the current user's role
    99             if ( isset( $current_options['roles'][$role] ) ) {
     102            if ( isset( $current_options['roles'][ $role ] ) ) {
    100103
    101104                // If any role for this user is set to Allow Full REST API Access, return true automatically
    102                 if ( true === $current_options['roles'][$role]['default_allow'] ) {
     105                if ( true === $current_options['roles'][ $role ]['default_allow'] ) {
    103106                    return true;
    104107                }
    … …  
    215218        if ( ! DRA_Helpers::is_valid_role( $role ) ) {
    216219            add_settings_error( 'DRA-notices', esc_attr( 'settings_updated' ), esc_html__( 'Invalid user role detected when processing form. No updates have been made.', 'disable-json-api' ), 'error' );
     220
    217221            return;
    218222        }
    … …  
    232236            // Unauthorized users default to no routes allowed. All other user roles default to allowing all routes
    233237            $rest_routes_for_setting = DRA_Helpers::build_routes_rule_for_all( $default_allow );
    234             $msg = esc_html__( 'All allowlists have been reset for this user role.', 'disable-json-api' );
     238            $msg                     = esc_html__( 'All allowlists have been reset for this user role.', 'disable-json-api' );
    235239
    236240        } else {
    … …  
    238242            // Get back the full list of true/false routes based on the posted routes allowed
    239243            $rest_routes_for_setting = DRA_Helpers::build_routes_rule( $rest_routes );
    240             $msg = esc_html__( 'Allowlist settings saved for this user role.', 'disable-json-api' );
     244            $msg                     = esc_html__( 'Allowlist settings saved for this user role.', 'disable-json-api' );
    241245
    242246        }
    243247
    244248        // Save only the rules for this role back to itself
    245         $arr_option['roles'][$role] = array(
    246             'default_allow'     => $default_allow,
    247             'allow_list'        => $rest_routes_for_setting,
     249        $arr_option['roles'][ $role ] = array(
     250            'default_allow' => $default_allow,
     251            'allow_list'    => $rest_routes_for_setting,
    248252        );
    249253
    … …  
    274278     */
    275279    private function get_wp_error( $access ) {
    276         $error_message = esc_html__( 'DRA: Only authenticated users can access the REST API.', 'disable-json-api' );
     280        $dra_error_message = apply_filters( 'dra_error_message', 'DRA: Only authenticated users can access the REST API.', $access );
     281        $error_message     = esc_html__( $dra_error_message, 'disable-json-api' );
    277282
    278283        if ( is_wp_error( $access ) ) {
    … …  
    292297
    293298        // If our new option already exists, we can bail
    294         if ( get_option( 'disable_rest_api_options') ) {
     299        if ( get_option( 'disable_rest_api_options' ) ) {
    295300            return;
    296301        }
    … …  
    309314        // Define the basic structure of our new option
    310315        $arr_option = array(
    311             'version'           => self::VERSION,       // the current version of this plugin
    312             'default_allow'     => true,                // if a role is not specifically defined in the settings, should the default be to ALLOW the route or not?
    313             'roles'             => array(),             // array of the user roles in this install of wordpress
     316            'version'       => self::VERSION,       // the current version of this plugin
     317            'default_allow' => true,                // if a role is not specifically defined in the settings, should the default be to ALLOW the route or not?
     318            'roles'         => array(),             // array of the user roles in this install of wordpress
    314319        );
    315320
    … …  
    325330        // Define the "unauthenticated" rules based on the old option value (or default value of "nothing")
    326331        $arr_option['roles']['none'] = array(
    327             'default_allow'     => false,
    328             'allow_list'        => $new_unauthenticated_rules,
     332            'default_allow' => false,
     333            'allow_list'    => $new_unauthenticated_rules,
    329334        );
    330335
    … …  
    353358
    354359        $user = wp_get_current_user();
     360
    355361        return ( array ) $user->roles;
    356362

  • disable-json-api/trunk/classes/helpers.php

    r2474673 r2966789  
    11<?php
     2
    23class DRA_Helpers {
    34
    … …  
    89     */
    910    static function get_all_rest_routes() {
    10         $wp_rest_server     = rest_get_server();
     11        $wp_rest_server = rest_get_server();
     12
    1113        return array_keys( $wp_rest_server->get_routes() );
    1214    }
    … …  
    1921     */
    2022    static function get_all_rest_namespaces() {
    21         $wp_rest_server     = rest_get_server();
     23        $wp_rest_server = rest_get_server();
     24
    2225        return $wp_rest_server->get_namespaces();
    2326    }
    … …  
    4548                $new_value = true;
    4649            }
    47             $new_rules[esc_html($route)] = $new_value;
     50            $new_rules[ esc_html( $route ) ] = $new_value;
    4851        }
    4952
    … …  
    6972        // Loop through ALL routes, set all to the desired value
    7073        foreach ( $all_routes as $route ) {
    71             $new_rules[esc_html($route)] = $default_value;
     74            $new_rules[ esc_html( $route ) ] = $default_value;
    7275        }
    7376
    … …  
    120123        }
    121124
    122         $option_rules = array();
     125        $option_rules  = array();
    123126        $allowed_rules = array();
    124127
    … …  
    129132            $option_rules = ( array ) DRA_Helpers::build_routes_rule( $arr_option );
    130133
    131         } elseif ( isset( $arr_option['roles'][$role]['allow_list'] ) ) {
     134        } elseif ( isset( $arr_option['roles'][ $role ]['allow_list'] ) ) {
    132135
    133136            // If we have a definition for the currently requested role, return it
    134             $option_rules = ( array ) $arr_option['roles'][$role]['allow_list'];
     137            $option_rules = ( array ) $arr_option['roles'][ $role ]['allow_list'];
    135138
    136139        } else {
    … …  
    175178        $default_allow = ( 'none' == $role ) ? false : true;
    176179
    177         if ( isset( $arr_option['roles'][$role]['default_allow'] ) ) {
    178             $default_allow = $arr_option['roles'][$role]['default_allow'];
     180        if ( isset( $arr_option['roles'][ $role ]['default_allow'] ) ) {
     181            $default_allow = $arr_option['roles'][ $role ]['default_allow'];
    179182        }
    180183
    … …  
    199202
    200203        $editable_roles = get_editable_roles();
    201         if ( isset( $editable_roles[$role] ) ) {
    202             return translate_user_role( $editable_roles[$role]['name'] );
     204        if ( isset( $editable_roles[ $role ] ) ) {
     205            return translate_user_role( $editable_roles[ $role ]['name'] );
    203206        }
    204207

  • disable-json-api/trunk/classes/requirements-check.php

    r2474673 r2966789  
    1515    public function __construct( $args ) {
    1616        foreach ( array( 'title', 'php', 'wp', 'file' ) as $setting ) {
    17             if ( isset( $args[$setting] ) ) {
    18                 $this->$setting = $args[$setting];
     17            if ( isset( $args[ $setting ] ) ) {
     18                $this->$setting = $args[ $setting ];
    1919            }
    2020        }
    … …  
    2626            add_action( 'admin_notices', array( $this, 'deactivate' ) );
    2727        }
     28
    2829        return $passes;
    2930    }
    … …  
    4041        } else {
    4142            add_action( 'admin_notices', array( $this, 'php_version_notice' ) );
     43
    4244            return false;
    4345        }
    … …  
    5961        } else {
    6062            add_action( 'admin_notices', array( $this, 'wp_version_notice' ) );
     63
    6164            return false;
    6265        }

  • disable-json-api/trunk/disable-json-api.php

    r2574374 r2966789  
    44 * Plugin URI: http://www.binarytemplar.com/disable-json-api
    55 * Description: Disable the use of the REST API on your website to anonymous users. You can optionally enable select endpoints if you wish. Now with support for User Roles!
    6  * Version: 1.7
     6 * Version: 1.8
     7 * Requires at least: 4.9
     8 * Requires PHP: 5.6
    79 * Author: Dave McHale
    810 * Author URI: http://www.binarytemplar.com
     11 * License: GPL2+
     12 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
    913 * Text Domain: disable-json-api
    1014 * Domain Path: /languages
    11  * License: GPL2+
    1215 */
    1316
    … …  
    2831$dra_requirements_check = new DRA_Requirements_Check( array(
    2932    'title' => 'Disable REST API',
    30     'php'   => '5.3',
    31     'wp'    => '4.4',
     33    'php'   => '5.6',
     34    'wp'    => '4.9',
    3235    'file'  => __FILE__,
    3336) );
    … …  
    4144    remove_action( 'template_redirect', 'rest_output_link_header', 11 );
    4245
    43     // WordPress 4.7+ disables the REST API via authentication short-circuit.
    44     // For versions of WordPress < 4.7, disable the REST API via filters
    45     if ( version_compare( get_bloginfo( 'version' ), '4.7', '>=' ) ) {
     46    // Load in extra classes
     47    require_once( plugin_dir_path( __FILE__ ) . 'classes/helpers.php' );
    4648
    47         // Load in extra classes
    48         require_once( plugin_dir_path( __FILE__ ) . 'classes/helpers.php' );
     49    // Only load admin classes if in admin area
     50    if ( is_admin() ) {
     51        require_once( plugin_dir_path( __FILE__ ) . 'classes/admin.php' );
     52    }
    4953
    50         // Only load admin classes if in admin area
    51         if ( is_admin() ) {
    52             require_once( plugin_dir_path( __FILE__ ) . 'classes/admin.php' );
    53         }
    54 
    55         // Load the primary Disable_REST_API class
    56         require_once( plugin_dir_path( __FILE__ ) . 'classes/disable-rest-api.php' );
    57         new Disable_REST_API( __FILE__ );
    58 
    59     } else {
    60         require_once( plugin_dir_path( __FILE__ ) . 'functions/legacy.php' );
    61         DRA_Disable_Via_Filters();
    62     }
     54    // Load the primary Disable_REST_API class
     55    require_once( plugin_dir_path( __FILE__ ) . 'classes/disable-rest-api.php' );
     56    new Disable_REST_API( __FILE__ );
    6357
    6458}

  • disable-json-api/trunk/readme.txt

    r2574374 r2966789  
    22Contributors: dmchale, tangrufus
    33Tags: admin, api, json, REST, rest-api, disable
    4 Requires at least: 4.4
     4Requires at least: 4.9
    55Requires PHP: 5.6
    6 Tested up to: 5.8
    7 Stable tag: 1.7
     6Tested up to: 6.3
     7Stable tag: 1.8
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4646
    4747== Changelog ==
     48
     49= 1.8 =
     50* Tested up to WP v6.3
     51* Added `dra_error_message` filter so devs can customize the access error message
     52* Fixed bug that caused fatal errors if activating plugin on installations running the LearnPress plugin
     53* Changed minimum requirements to PHP 5.6 (up from 5.3) and WordPress 4.9 (up from 4.4). Adding docblock comments to support minimums.
    4854
    4955= 1.7 =
    … …  
    100106== Upgrade Notice ==
    101107
     108= 1.8 =
     109* Improved UI/UX of admin settings page to better manage routes
     110
    102111= 1.6 =
    103112* By popular request... now with User Role support!
Note: See TracChangeset for help on using the changeset viewer.