Completed
Push — update/dialogue-focus-on-conte... ( 9f1745...fa862f )
by
unknown
80:03 queued 71:18
created

class.wpcom-json-api-list-posts-endpoint.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
new WPCOM_JSON_API_List_Posts_Endpoint( array(
4
	'description' => 'Get a list of matching posts.',
5
	'new_version' => '1.1',
6
	'max_version' => '1',
7
	'group'       => 'posts',
8
	'stat'        => 'posts',
9
10
	'method'      => 'GET',
11
	'path'        => '/sites/%s/posts/',
12
	'path_labels' => array(
13
		'$site' => '(int|string) Site ID or domain',
14
	),
15
16
	'allow_fallback_to_jetpack_blog_token' => true,
17
18
	'query_parameters' => array(
19
		'number'   => '(int=20) The number of posts to return. Limit: 100.',
20
		'offset'   => '(int=0) 0-indexed offset.',
21
		'page'     => '(int) Return the Nth 1-indexed page of posts. Takes precedence over the <code>offset</code> parameter.',
22
		'order'    => array(
23
			'DESC' => 'Return posts in descending order. For dates, that means newest to oldest.',
24
			'ASC'  => 'Return posts in ascending order. For dates, that means oldest to newest.',
25
		),
26
		'order_by' => array(
27
			'date'          => 'Order by the created time of each post.',
28
			'modified'      => 'Order by the modified time of each post.',
29
			'title'         => "Order lexicographically by the posts' titles.",
30
			'comment_count' => 'Order by the number of comments for each post.',
31
			'ID'            => 'Order by post ID.',
32
		),
33
		'after'    => '(ISO 8601 datetime) Return posts dated on or after the specified datetime.',
34
		'before'   => '(ISO 8601 datetime) Return posts dated on or before the specified datetime.',
35
		'tag'      => '(string) Specify the tag name or slug.',
36
		'category' => '(string) Specify the category name or slug.',
37
		'term'     => '(object:string) Specify comma-separated term slugs to search within, indexed by taxonomy slug.',
38
		'type'     => "(string) Specify the post type. Defaults to 'post', use 'any' to query for both posts and pages. Post types besides post and page need to be whitelisted using the <code>rest_api_allowed_post_types</code> filter.",
39
		'parent_id' => '(int) Returns only posts which are children of the specified post. Applies only to hierarchical post types.',
40
		'exclude'  => '(array:int|int) Excludes the specified post ID(s) from the response',
41
		'exclude_tree' => '(int) Excludes the specified post and all of its descendants from the response. Applies only to hierarchical post types.',
42
		'status'   => array(
43
			'publish' => 'Return only published posts.',
44
			'private' => 'Return only private posts.',
45
			'draft'   => 'Return only draft posts.',
46
			'pending' => 'Return only posts pending editorial approval.',
47
			'future'  => 'Return only posts scheduled for future publishing.',
48
			'trash'   => 'Return only posts in the trash.',
49
			'any'     => 'Return all posts regardless of status.',
50
		),
51
		'sticky'    => array(
52
			'false'   => 'Post is not marked as sticky.',
53
			'true'    => 'Stick the post to the front page.',
54
		),
55
		'author'   => "(int) Author's user ID",
56
		'search'   => '(string) Search query',
57
		'meta_key'   => '(string) Metadata key that the post should contain',
58
		'meta_value'   => '(string) Metadata value that the post should contain. Will only be applied if a `meta_key` is also given',
59
	),
60
61
	'example_request' => 'https://public-api.wordpress.com/rest/v1/sites/en.blog.wordpress.com/posts/?number=5'
62
) );
63
64
class WPCOM_JSON_API_List_Posts_Endpoint extends WPCOM_JSON_API_Post_Endpoint {
65
	public $date_range = array();
66
67
	public $response_format = array(
68
		'found'    => '(int) The total number of posts found that match the request (ignoring limits, offsets, and pagination).',
69
		'posts'    => '(array:post) An array of post objects.',
70
	);
71
72
	// /sites/%s/posts/ -> $blog_id
73
	function callback( $path = '', $blog_id = 0 ) {
74
		$blog_id = $this->api->switch_to_blog_and_validate_user( $this->api->get_blog_id( $blog_id ) );
75
		if ( is_wp_error( $blog_id ) ) {
76
			return $blog_id;
77
		}
78
79
		$args = $this->query_args();
80
81
		if ( $args['number'] < 1 ) {
82
			$args['number'] = 20;
83
		} elseif ( 100 < $args['number'] ) {
84
			return new WP_Error( 'invalid_number',  'The NUMBER parameter must be less than or equal to 100.', 400 );
0 ignored issues
show
The call to WP_Error::__construct() has too many arguments starting with 'invalid_number'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
85
		}
86
87 View Code Duplication
		if ( isset( $args['type'] ) && ! $this->is_post_type_allowed( $args['type'] ) ) {
88
			return new WP_Error( 'unknown_post_type', 'Unknown post type', 404 );
0 ignored issues
show
The call to WP_Error::__construct() has too many arguments starting with 'unknown_post_type'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
89
		}
90
91
		// Normalize post_type
92 View Code Duplication
		if ( isset( $args['type'] ) && 'any' == $args['type'] ) {
93
			if ( version_compare( $this->api->version, '1.1', '<' ) ) {
94
				$args['type'] = array( 'post', 'page' );
95
			} else { // 1.1+
96
				$args['type'] = $this->_get_whitelisted_post_types();
97
			}
98
		}
99
100
		// determine statuses
101
		$status = $args['status'];
102
		$status = ( $status ) ? explode( ',', $status ) : array( 'publish' );
103 View Code Duplication
		if ( is_user_logged_in() ) {
104
			$statuses_whitelist = array(
105
				'publish',
106
				'pending',
107
				'draft',
108
				'future',
109
				'private',
110
				'trash',
111
				'any',
112
			);
113
			$status = array_intersect( $status, $statuses_whitelist );
114
		} else {
115
			// logged-out users can see only published posts
116
			$statuses_whitelist = array( 'publish', 'any' );
117
			$status = array_intersect( $status, $statuses_whitelist );
118
119
			if ( empty( $status ) ) {
120
				// requested only protected statuses? nothing for you here
121
				return array( 'found' => 0, 'posts' => array() );
122
			}
123
			// clear it (AKA published only) because "any" includes protected
124
			$status = array();
125
		}
126
127
		// let's be explicit about defaulting to 'post'
128
		$args['type'] = isset( $args['type'] ) ? $args['type'] : 'post';
129
130
		// make sure the user can read or edit the requested post type(s)
131 View Code Duplication
		if ( is_array( $args['type'] ) ) {
132
			$allowed_types = array();
133
			foreach ( $args['type'] as $post_type ) {
134
				if ( $this->current_user_can_access_post_type( $post_type, $args['context'] ) ) {
135
				   	$allowed_types[] = $post_type;
136
				}
137
			}
138
139
			if ( empty( $allowed_types ) ) {
140
				return array( 'found' => 0, 'posts' => array() );
141
			}
142
			$args['type'] = $allowed_types;
143
		}
144
		else {
145
			if ( ! $this->current_user_can_access_post_type( $args['type'], $args['context'] ) ) {
146
				return array( 'found' => 0, 'posts' => array() );
147
			}
148
		}
149
150
		$query = array(
151
			'posts_per_page' => $args['number'],
152
			'order'          => $args['order'],
153
			'orderby'        => $args['order_by'],
154
			'post_type'      => $args['type'],
155
			'post_status'    => $status,
156
			'post_parent'    => isset( $args['parent_id'] ) ? $args['parent_id'] : null,
157
			'author'         => isset( $args['author'] ) && 0 < $args['author'] ? $args['author'] : null,
158
			's'              => isset( $args['search'] ) && '' !== $args['search'] ? $args['search'] : null,
159
			'fields'         => 'ids',
160
		);
161
162
		if ( ! is_user_logged_in () ) {
163
			$query['has_password'] = false;
164
		}
165
166 View Code Duplication
		if ( isset( $args['meta_key'] ) ) {
167
			$show = false;
168
			if ( WPCOM_JSON_API_Metadata::is_public( $args['meta_key'] ) )
169
				$show = true;
170
			if ( current_user_can( 'edit_post_meta', $query['post_type'], $args['meta_key'] ) )
171
				$show = true;
172
173
			if ( is_protected_meta( $args['meta_key'], 'post' ) && ! $show )
174
				return new WP_Error( 'invalid_meta_key', 'Invalid meta key', 404 );
0 ignored issues
show
The call to WP_Error::__construct() has too many arguments starting with 'invalid_meta_key'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
175
176
			$meta = array( 'key' => $args['meta_key'] );
177
			if ( isset( $args['meta_value'] ) )
178
				$meta['value'] = $args['meta_value'];
179
180
			$query['meta_query'] = array( $meta );
181
		}
182
183
		if (
184
			isset( $args['sticky'] )
185
		&&
186
			( $sticky = get_option( 'sticky_posts' ) )
187
		&&
188
			is_array( $sticky )
189
		) {
190
			if ( $args['sticky'] ) {
191
				$query['post__in'] = $sticky;
192
			} else {
193
				$query['post__not_in'] = $sticky;
194
				$query['ignore_sticky_posts'] = 1;
195
			}
196
		} else {
197
				$query['post__not_in'] = $sticky;
198
				$query['ignore_sticky_posts'] = 1;
199
		}
200
201
		if ( isset( $args['exclude'] ) ) {
202
			$query['post__not_in'] = array_merge( $query['post__not_in'], (array) $args['exclude'] );
203
		}
204
205 View Code Duplication
		if ( isset( $args['exclude_tree'] ) && is_post_type_hierarchical( $args['type'] ) ) {
206
			// get_page_children is a misnomer; it supports all hierarchical post types
207
			$page_args = array(
208
					'child_of' => $args['exclude_tree'],
209
					'post_type' => $args['type'],
210
					// since we're looking for things to exclude, be aggressive
211
					'post_status' => 'publish,draft,pending,private,future,trash',
212
				);
213
			$post_descendants = get_pages( $page_args );
214
215
			$exclude_tree = array( $args['exclude_tree'] );
216
			foreach ( $post_descendants as $child ) {
217
				$exclude_tree[] = $child->ID;
218
			}
219
220
			$query['post__not_in'] = isset( $query['post__not_in'] ) ? array_merge( $query['post__not_in'], $exclude_tree ) : $exclude_tree;
221
		}
222
223 View Code Duplication
		if ( isset( $args['category'] ) ) {
224
			$category = get_term_by( 'slug', $args['category'], 'category' );
225
			if ( $category === false) {
226
				$query['category_name'] = $args['category'];
227
			} else {
228
				$query['cat'] = $category->term_id;
229
			}
230
		}
231
232
		if ( isset( $args['tag'] ) ) {
233
			$query['tag'] = $args['tag'];
234
		}
235
236 View Code Duplication
		if ( ! empty( $args['term'] ) ) {
237
			$query['tax_query'] = array();
238
			foreach ( $args['term'] as $taxonomy => $slug ) {
239
				$taxonomy_object = get_taxonomy( $taxonomy );
240
				if ( false === $taxonomy_object || ( ! $taxonomy_object->public &&
241
						! current_user_can( $taxonomy_object->cap->assign_terms ) ) ) {
242
					continue;
243
				}
244
245
				$query['tax_query'][] = array(
246
					'taxonomy' => $taxonomy,
247
					'field' => 'slug',
248
					'terms' => explode( ',', $slug )
249
				);
250
			}
251
		}
252
253
		if ( isset( $args['page'] ) ) {
254
			if ( $args['page'] < 1 ) {
255
				$args['page'] = 1;
256
			}
257
258
			$query['paged'] = $args['page'];
259
		} else {
260
			if ( $args['offset'] < 0 ) {
261
				$args['offset'] = 0;
262
			}
263
264
			$query['offset'] = $args['offset'];
265
		}
266
267
		if ( isset( $args['before'] ) ) {
268
			$this->date_range['before'] = $args['before'];
269
		}
270
		if ( isset( $args['after'] ) ) {
271
			$this->date_range['after'] = $args['after'];
272
		}
273
274
		if ( $this->date_range ) {
275
			add_filter( 'posts_where', array( $this, 'handle_date_range' ) );
276
		}
277
278
		/**
279
		 * 'column' necessary for the me/posts endpoint (which extends sites/$site/posts).
280
		 * Would need to be added to the sites/$site/posts definition if we ever want to
281
		 * use it there.
282
		 */
283
		$column_whitelist = array( 'post_modified_gmt' );
284 View Code Duplication
		if ( isset( $args['column'] ) && in_array( $args['column'], $column_whitelist ) ) {
285
			$query['column'] = $args['column'];
286
		}
287
288
		$wp_query = new WP_Query( $query );
289
		if ( $this->date_range ) {
290
			remove_filter( 'posts_where', array( $this, 'handle_date_range' ) );
291
			$this->date_range = array();
292
		}
293
294
		$return = array();
295
		$excluded_count = 0;
296
		foreach ( array_keys( $this->response_format ) as $key ) {
297
			switch ( $key ) {
298
			case 'found' :
299
				$return[$key] = (int) $wp_query->found_posts;
300
				break;
301
			case 'posts' :
302
				$posts = array();
303
				foreach ( $wp_query->posts as $post_ID ) {
304
					$the_post = $this->get_post_by( 'ID', $post_ID, $args['context'] );
305
					if ( $the_post && ! is_wp_error( $the_post ) ) {
306
						$posts[] = $the_post;
307
					} else {
308
						$excluded_count++;
309
					}
310
				}
311
312
				if ( $posts ) {
313
					/** This action is documented in json-endpoints/class.wpcom-json-api-site-settings-endpoint.php */
314
					do_action( 'wpcom_json_api_objects', 'posts', count( $posts ) );
315
				}
316
317
				$return[$key] = $posts;
318
				break;
319
			}
320
		}
321
322
		$return['found'] -= $excluded_count;
323
324
		return $return;
325
	}
326
327 View Code Duplication
	function handle_date_range( $where ) {
328
		global $wpdb;
329
330
		switch ( count( $this->date_range ) ) {
331
		case 2 :
332
			$where .= $wpdb->prepare(
333
				" AND `$wpdb->posts`.post_date BETWEEN CAST( %s AS DATETIME ) AND CAST( %s AS DATETIME ) ",
334
				$this->date_range['after'],
335
				$this->date_range['before']
336
			);
337
			break;
338
		case 1 :
339
			if ( isset( $this->date_range['before'] ) ) {
340
				$where .= $wpdb->prepare(
341
					" AND `$wpdb->posts`.post_date <= CAST( %s AS DATETIME ) ",
342
					$this->date_range['before']
343
				);
344
			} else {
345
				$where .= $wpdb->prepare(
346
					" AND `$wpdb->posts`.post_date >= CAST( %s AS DATETIME ) ",
347
					$this->date_range['after']
348
				);
349
			}
350
			break;
351
		}
352
353
		return $where;
354
	}
355
}
356