AyeCode /
invoicing
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * REST API reports controller |
||
| 4 | * |
||
| 5 | * Handles requests to the /reports endpoint. |
||
| 6 | * |
||
| 7 | * @package GetPaid |
||
| 8 | * @subpackage REST API |
||
| 9 | * @since 2.0.0 |
||
| 10 | */ |
||
| 11 | |||
| 12 | defined( 'ABSPATH' ) || exit; |
||
| 13 | |||
| 14 | /** |
||
| 15 | * GetPaid REST reports controller class. |
||
| 16 | * |
||
| 17 | * @package Invoicing |
||
| 18 | */ |
||
| 19 | class GetPaid_REST_Reports_Controller extends GetPaid_REST_Controller { |
||
| 20 | |||
| 21 | /** |
||
| 22 | * Route base. |
||
| 23 | * |
||
| 24 | * @var string |
||
| 25 | */ |
||
| 26 | protected $rest_base = 'reports'; |
||
| 27 | |||
| 28 | /** |
||
| 29 | * Registers the routes for the objects of the controller. |
||
| 30 | * |
||
| 31 | * @since 2.0.0 |
||
| 32 | * |
||
| 33 | * @see register_rest_route() |
||
| 34 | */ |
||
| 35 | public function register_namespace_routes( $namespace ) { |
||
| 36 | |||
| 37 | // List all available reports. |
||
| 38 | register_rest_route( |
||
| 39 | $namespace, |
||
| 40 | $this->rest_base, |
||
| 41 | array( |
||
| 42 | array( |
||
| 43 | 'methods' => WP_REST_Server::READABLE, |
||
| 44 | 'callback' => array( $this, 'get_items' ), |
||
| 45 | 'permission_callback' => array( $this, 'get_items_permissions_check' ), |
||
| 46 | 'args' => $this->get_collection_params(), |
||
| 47 | ), |
||
| 48 | 'schema' => array( $this, 'get_public_item_schema' ), |
||
| 49 | ) |
||
| 50 | ); |
||
| 51 | |||
| 52 | } |
||
| 53 | |||
| 54 | /** |
||
| 55 | * Makes sure the current user has access to READ the report APIs. |
||
| 56 | * |
||
| 57 | * @since 2.0.0 |
||
| 58 | * @param WP_REST_Request $request Full data about the request. |
||
| 59 | * @return WP_Error|boolean |
||
| 60 | */ |
||
| 61 | public function get_items_permissions_check( $request ) { |
||
| 62 | |||
| 63 | if ( ! wpinv_current_user_can_manage_invoicing() ) { |
||
| 64 | return new WP_Error( 'rest_cannot_view', __( 'Sorry, you cannot list resources.', 'invoicing' ), array( 'status' => rest_authorization_required_code() ) ); |
||
| 65 | } |
||
| 66 | |||
| 67 | return true; |
||
| 68 | } |
||
| 69 | |||
| 70 | /** |
||
| 71 | * Get reports list. |
||
| 72 | * |
||
| 73 | * @since 2.0.0 |
||
| 74 | * @return array |
||
| 75 | */ |
||
| 76 | protected function get_reports() { |
||
| 77 | |||
| 78 | $reports = array( |
||
| 79 | array( |
||
| 80 | 'slug' => 'sales', |
||
| 81 | 'description' => __( 'List of sales reports.', 'invoicing' ), |
||
| 82 | ), |
||
| 83 | array( |
||
| 84 | 'slug' => 'top_sellers', |
||
| 85 | 'description' => __( 'List of top selling items.', 'invoicing' ), |
||
| 86 | ), |
||
| 87 | array( |
||
| 88 | 'slug' => 'top_earners', |
||
| 89 | 'description' => __( 'List of top earning items.', 'invoicing' ), |
||
| 90 | ), |
||
| 91 | array( |
||
| 92 | 'slug' => 'invoices/counts', |
||
| 93 | 'description' => __( 'Invoice counts.', 'invoicing' ), |
||
| 94 | ), |
||
| 95 | ); |
||
| 96 | |||
| 97 | return apply_filters( 'getpaid_available_api_reports', $reports ); |
||
| 98 | |||
| 99 | } |
||
| 100 | |||
| 101 | /** |
||
| 102 | * Get all reports. |
||
| 103 | * |
||
| 104 | * @since 2.0.0 |
||
| 105 | * @param WP_REST_Request $request |
||
| 106 | * @return array|WP_Error |
||
| 107 | */ |
||
| 108 | public function get_items( $request ) { |
||
| 109 | $data = array(); |
||
| 110 | $reports = $this->get_reports(); |
||
| 111 | |||
| 112 | foreach ( $reports as $report ) { |
||
| 113 | $item = $this->prepare_item_for_response( (object) $report, $request ); |
||
| 114 | $data[] = $this->prepare_response_for_collection( $item ); |
||
| 115 | } |
||
| 116 | |||
| 117 | return rest_ensure_response( $data ); |
||
|
0 ignored issues
–
show
Bug
Best Practice
introduced
by
Loading history...
|
|||
| 118 | } |
||
| 119 | |||
| 120 | /** |
||
| 121 | * Prepare a report object for serialization. |
||
| 122 | * |
||
| 123 | * @since 2.0.0 |
||
| 124 | * @param stdClass $report Report data. |
||
| 125 | * @param WP_REST_Request $request Request object. |
||
| 126 | * @return WP_REST_Response $response Response data. |
||
| 127 | */ |
||
| 128 | public function prepare_item_for_response( $report, $request ) { |
||
| 129 | $data = array( |
||
| 130 | 'slug' => $report->slug, |
||
| 131 | 'description' => $report->description, |
||
| 132 | ); |
||
| 133 | |||
| 134 | $context = ! empty( $request['context'] ) ? $request['context'] : 'view'; |
||
| 135 | $data = $this->add_additional_fields_to_object( $data, $request ); |
||
| 136 | $data = $this->filter_response_by_context( $data, $context ); |
||
| 137 | |||
| 138 | // Wrap the data in a response object. |
||
| 139 | $response = rest_ensure_response( $data ); |
||
| 140 | $response->add_links( |
||
| 141 | array( |
||
| 142 | 'self' => array( |
||
| 143 | 'href' => rest_url( sprintf( '/%s/%s/%s', $this->namespace, $this->rest_base, $report->slug ) ), |
||
| 144 | ), |
||
| 145 | 'collection' => array( |
||
| 146 | 'href' => rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ), |
||
| 147 | ), |
||
| 148 | ) |
||
| 149 | ); |
||
| 150 | |||
| 151 | return apply_filters( 'getpaid_rest_prepare_report', $response, $report, $request ); |
||
| 152 | } |
||
| 153 | |||
| 154 | /** |
||
| 155 | * Get the Report's schema, conforming to JSON Schema. |
||
| 156 | * |
||
| 157 | * @since 2.0.0 |
||
| 158 | * @return array |
||
| 159 | */ |
||
| 160 | public function get_item_schema() { |
||
| 161 | $schema = array( |
||
| 162 | '$schema' => 'http://json-schema.org/draft-04/schema#', |
||
| 163 | 'title' => 'report', |
||
| 164 | 'type' => 'object', |
||
| 165 | 'properties' => array( |
||
| 166 | 'slug' => array( |
||
| 167 | 'description' => __( 'An alphanumeric identifier for the resource.', 'invoicing' ), |
||
| 168 | 'type' => 'string', |
||
| 169 | 'context' => array( 'view' ), |
||
| 170 | 'readonly' => true, |
||
| 171 | ), |
||
| 172 | 'description' => array( |
||
| 173 | 'description' => __( 'A human-readable description of the resource.', 'invoicing' ), |
||
| 174 | 'type' => 'string', |
||
| 175 | 'context' => array( 'view' ), |
||
| 176 | 'readonly' => true, |
||
| 177 | ), |
||
| 178 | ), |
||
| 179 | ); |
||
| 180 | |||
| 181 | return $this->add_additional_fields_schema( $schema ); |
||
| 182 | } |
||
| 183 | |||
| 184 | /** |
||
| 185 | * Get the query params for collections. |
||
| 186 | * |
||
| 187 | * @since 2.0.0 |
||
| 188 | * @return array |
||
| 189 | */ |
||
| 190 | public function get_collection_params() { |
||
| 191 | return array( |
||
| 192 | 'context' => $this->get_context_param( array( 'default' => 'view' ) ), |
||
| 193 | ); |
||
| 194 | } |
||
| 195 | } |
||
| 196 |