This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | /** |
||
3 | * REST API reports controller |
||
4 | * |
||
5 | * Handles requests to the /reports endpoint. |
||
6 | * |
||
7 | * @package GetPaid |
||
8 | * @subpackage REST API |
||
9 | * @since 2.0.0 |
||
10 | */ |
||
11 | |||
12 | defined( 'ABSPATH' ) || exit; |
||
13 | |||
14 | /** |
||
15 | * GetPaid REST reports controller class. |
||
16 | * |
||
17 | * @package Invoicing |
||
18 | */ |
||
19 | class GetPaid_REST_Reports_Controller extends GetPaid_REST_Controller { |
||
20 | |||
21 | /** |
||
22 | * Route base. |
||
23 | * |
||
24 | * @var string |
||
25 | */ |
||
26 | protected $rest_base = 'reports'; |
||
27 | |||
28 | /** |
||
29 | * Registers the routes for the objects of the controller. |
||
30 | * |
||
31 | * @since 2.0.0 |
||
32 | * |
||
33 | * @see register_rest_route() |
||
34 | */ |
||
35 | public function register_namespace_routes( $namespace ) { |
||
36 | |||
37 | // List all available reports. |
||
38 | register_rest_route( |
||
39 | $namespace, |
||
40 | $this->rest_base, |
||
41 | array( |
||
42 | array( |
||
43 | 'methods' => WP_REST_Server::READABLE, |
||
44 | 'callback' => array( $this, 'get_items' ), |
||
45 | 'permission_callback' => array( $this, 'get_items_permissions_check' ), |
||
46 | 'args' => $this->get_collection_params(), |
||
47 | ), |
||
48 | 'schema' => array( $this, 'get_public_item_schema' ), |
||
49 | ) |
||
50 | ); |
||
51 | |||
52 | } |
||
53 | |||
54 | /** |
||
55 | * Makes sure the current user has access to READ the report APIs. |
||
56 | * |
||
57 | * @since 2.0.0 |
||
58 | * @param WP_REST_Request $request Full data about the request. |
||
59 | * @return WP_Error|boolean |
||
60 | */ |
||
61 | public function get_items_permissions_check( $request ) { |
||
62 | |||
63 | if ( ! wpinv_current_user_can_manage_invoicing() ) { |
||
64 | return new WP_Error( 'rest_cannot_view', __( 'Sorry, you cannot list resources.', 'invoicing' ), array( 'status' => rest_authorization_required_code() ) ); |
||
65 | } |
||
66 | |||
67 | return true; |
||
68 | } |
||
69 | |||
70 | /** |
||
71 | * Get reports list. |
||
72 | * |
||
73 | * @since 2.0.0 |
||
74 | * @return array |
||
75 | */ |
||
76 | protected function get_reports() { |
||
77 | |||
78 | $reports = array( |
||
79 | array( |
||
80 | 'slug' => 'sales', |
||
81 | 'description' => __( 'List of sales reports.', 'invoicing' ), |
||
82 | ), |
||
83 | array( |
||
84 | 'slug' => 'top_sellers', |
||
85 | 'description' => __( 'List of top selling items.', 'invoicing' ), |
||
86 | ), |
||
87 | array( |
||
88 | 'slug' => 'top_earners', |
||
89 | 'description' => __( 'List of top earning items.', 'invoicing' ), |
||
90 | ), |
||
91 | array( |
||
92 | 'slug' => 'invoices/counts', |
||
93 | 'description' => __( 'Invoice counts.', 'invoicing' ), |
||
94 | ), |
||
95 | ); |
||
96 | |||
97 | return apply_filters( 'getpaid_available_api_reports', $reports ); |
||
98 | |||
99 | } |
||
100 | |||
101 | /** |
||
102 | * Get all reports. |
||
103 | * |
||
104 | * @since 2.0.0 |
||
105 | * @param WP_REST_Request $request |
||
106 | * @return array|WP_Error |
||
107 | */ |
||
108 | public function get_items( $request ) { |
||
109 | $data = array(); |
||
110 | $reports = $this->get_reports(); |
||
111 | |||
112 | foreach ( $reports as $report ) { |
||
113 | $item = $this->prepare_item_for_response( (object) $report, $request ); |
||
114 | $data[] = $this->prepare_response_for_collection( $item ); |
||
115 | } |
||
116 | |||
117 | return rest_ensure_response( $data ); |
||
0 ignored issues
–
show
Bug
Best Practice
introduced
by
![]() |
|||
118 | } |
||
119 | |||
120 | /** |
||
121 | * Prepare a report object for serialization. |
||
122 | * |
||
123 | * @since 2.0.0 |
||
124 | * @param stdClass $report Report data. |
||
125 | * @param WP_REST_Request $request Request object. |
||
126 | * @return WP_REST_Response $response Response data. |
||
127 | */ |
||
128 | public function prepare_item_for_response( $report, $request ) { |
||
129 | $data = array( |
||
130 | 'slug' => $report->slug, |
||
131 | 'description' => $report->description, |
||
132 | ); |
||
133 | |||
134 | $context = ! empty( $request['context'] ) ? $request['context'] : 'view'; |
||
135 | $data = $this->add_additional_fields_to_object( $data, $request ); |
||
136 | $data = $this->filter_response_by_context( $data, $context ); |
||
137 | |||
138 | // Wrap the data in a response object. |
||
139 | $response = rest_ensure_response( $data ); |
||
140 | $response->add_links( |
||
141 | array( |
||
142 | 'self' => array( |
||
143 | 'href' => rest_url( sprintf( '/%s/%s/%s', $this->namespace, $this->rest_base, $report->slug ) ), |
||
144 | ), |
||
145 | 'collection' => array( |
||
146 | 'href' => rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ), |
||
147 | ), |
||
148 | ) |
||
149 | ); |
||
150 | |||
151 | return apply_filters( 'getpaid_rest_prepare_report', $response, $report, $request ); |
||
152 | } |
||
153 | |||
154 | /** |
||
155 | * Get the Report's schema, conforming to JSON Schema. |
||
156 | * |
||
157 | * @since 2.0.0 |
||
158 | * @return array |
||
159 | */ |
||
160 | public function get_item_schema() { |
||
161 | $schema = array( |
||
162 | '$schema' => 'http://json-schema.org/draft-04/schema#', |
||
163 | 'title' => 'report', |
||
164 | 'type' => 'object', |
||
165 | 'properties' => array( |
||
166 | 'slug' => array( |
||
167 | 'description' => __( 'An alphanumeric identifier for the resource.', 'invoicing' ), |
||
168 | 'type' => 'string', |
||
169 | 'context' => array( 'view' ), |
||
170 | 'readonly' => true, |
||
171 | ), |
||
172 | 'description' => array( |
||
173 | 'description' => __( 'A human-readable description of the resource.', 'invoicing' ), |
||
174 | 'type' => 'string', |
||
175 | 'context' => array( 'view' ), |
||
176 | 'readonly' => true, |
||
177 | ), |
||
178 | ), |
||
179 | ); |
||
180 | |||
181 | return $this->add_additional_fields_schema( $schema ); |
||
182 | } |
||
183 | |||
184 | /** |
||
185 | * Get the query params for collections. |
||
186 | * |
||
187 | * @since 2.0.0 |
||
188 | * @return array |
||
189 | */ |
||
190 | public function get_collection_params() { |
||
191 | return array( |
||
192 | 'context' => $this->get_context_param( array( 'default' => 'view' ) ), |
||
193 | ); |
||
194 | } |
||
195 | } |
||
196 |