Completed
Push — develop ( 118b22...40c91a )
by Gennady
17:25
created

Views_Route::prepare_entry_for_response()   C

Complexity

Conditions 11
Paths 150

Size

Total Lines 79

Duplication

Lines 0
Ratio 0 %

Code Coverage

Tests 26
CRAP Score 12.1545

Importance

Changes 0
Metric Value
cc 11
nc 150
nop 5
dl 0
loc 79
ccs 26
cts 33
cp 0.7879
crap 12.1545
rs 5.9781
c 0
b 0
f 0

How to fix   Long Method    Complexity   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php
0 ignored issues
show
Coding Style Compatibility introduced by
For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 18 and the first side effect is on line 15.

The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.

The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.

To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.

Loading history...
2
/**
3
 * @package   GravityView
4
 * @license   GPL2+
5
 * @author    Josh Pollock <[email protected]>
6
 * @link      http://gravityview.co
7
 * @copyright Copyright 2015, Katz Web Services, Inc.
8
 *
9
 * @since 2.0
10
 */
11
namespace GV\REST;
12
13
/** If this file is called directly, abort. */
14 1
if ( ! defined( 'GRAVITYVIEW_DIR' ) ) {
15
	die();
16
}
17
18
class Views_Route extends Route {
19
	/**
20
	 * Route Name
21
	 *
22
	 * @since 2.0
23
	 *
24
	 * @access protected
25
	 * @string
26
	 */
27
	protected $route_name = 'views';
28
29
	/**
30
	 * Sub type, forms {$namespace}/route_name/{id}/sub_type type endpoints
31
	 *
32
	 * @since 2.0
33
	 * @access protected
34
	 * @var string
35
	 */
36
	protected $sub_type = 'entries';
37
38
39
	/**
40
	 * Get a collection of views
41
	 *
42
	 * Callback for GET /v1/views/
43
	 *
44
	 * @param \WP_REST_Request $request Full data about the request.
45
	 * @return \WP_Error|\WP_REST_Response
46
	 */
47 3
	public function get_items( $request ) {
48
49 3
		$page = $request->get_param( 'page' );
50 3
		$limit = $request->get_param( 'limit' );
51
52 3
		$items = \GVCommon::get_all_views( array(
53 3
			'posts_per_page' => $limit,
54 3
			'paged' => $page,
55
		) );
56
57 3
		if ( empty( $items ) ) {
58
			return new \WP_Error( 'gravityview-no-views', __( 'No Views found.', 'gravityview' ) ); //@todo message
59
		}
60
61
		$data = array(
62 3
			'views' => array(),
63 3
			'total' => wp_count_posts( 'gravityview' )->publish,
64
		);
65 3
		foreach ( $items as $item ) {
66 3
			$data['views'][] = $this->prepare_view_for_response( $item, $request );
67
		}
68
69 3
		return new \WP_REST_Response( $data, 200 );
70
	}
71
72
	/**
73
	 * Get one view
74
	 *
75
	 * Callback for /v1/views/{id}/
76
	 *
77
	 * @since 2.0
78
	 * @param \WP_REST_Request $request Full data about the request.
79
	 * @return \WP_Error|\WP_REST_Response
80
	 */
81 2
	public function get_item( $request ) {
82
83 2
		$url = $request->get_url_params();
84
85 2
		$view_id = intval( $url['id'] );
86
87 2
		$item = get_post( $view_id );
88
89
		//return a response or error based on some conditional
90 2
		if ( $item && ! is_wp_error( $item ) ) {
91 2
			$data = $this->prepare_view_for_response( $item, $request );
92 2
			return new \WP_REST_Response( $data, 200 );
93
		}
94
95
		return new \WP_Error( 'code', sprintf( 'A View with ID #%d was not found.', $view_id ) );
96
	}
97
98
	/**
99
	 * Prepare the item for the REST response
100
	 *
101
	 * @since 2.0
102
	 * @param \GV\View $view The view.
103
	 * @param \GV\Entry $entry WordPress representation of the item.
104
	 * @param \WP_REST_Request $request Request object.
105
	 * @param string $context The context (directory, single)
106
	 * @param string $class The value renderer. Default: null (raw value)
107
	 *
108
	 * @since 2.1 Add value renderer override $class parameter.
109
	 *
110
	 * @return mixed The data that is sent.
111
	 */
112 5
	public function prepare_entry_for_response( $view, $entry, \WP_REST_Request $request, $context, $class = null ) {
113
114
		// Only output the fields that should be displayed.
115 5
		$allowed = array();
116 5
		foreach ( $view->fields->by_position( "{$context}_*" )->by_visible()->all() as $field ) {
117 5
			$allowed[] = $field;
118
		}
119
120
		/**
121
		 * @filter `gravityview/rest/entry/fields` Whitelist more entry fields that are output in regular REST requests.
122
		 * @param[in,out] array $allowed The allowed ones, default by_visible, by_position( "context_*" ), i.e. as set in the view.
123
		 * @param \GV\View $view The view.
124
		 * @param \GV\Entry $entry The entry.
125
		 * @param \WP_REST_Request $request Request object.
126
		 * @param string $context The context (directory, single)
127
		 */
128 5
		$allowed_field_ids = apply_filters( 'gravityview/rest/entry/fields', wp_list_pluck( $allowed, 'ID' ), $view, $entry, $request, $context );
129
130 5
		$allowed = array_filter( $allowed, function( $field ) use ( $allowed_field_ids ) {
131 5
			return in_array( $field->ID, $allowed_field_ids, true );
132 5
		} );
133
134 5
		// Tack on additional fields if needed
135 2
		foreach ( array_diff( $allowed_field_ids, wp_list_pluck( $allowed, 'ID' ) ) as $field_id ) {
136
			$allowed[] = is_numeric( $field_id ) ? \GV\GF_Field::by_id( $view->form, $field_id ) : \GV\Internal_Field::by_id( $field_id );
137
		}
138 5
139 5
		$r = new Request( $request );
140
		$return = array();
141 5
142 5
		$renderer = new \GV\Field_Renderer();
143
		
144 2
		$used_ids = array();
145
146
		foreach ( $allowed as $field ) {
147 5
			$source = is_numeric( $field->ID ) ? $view->form : new \GV\Internal_Source();
148 2
149
			$field_id = $field->ID;
150 5
			$index = null;
151
152
			if ( ! isset( $used_ids[ $field_id ] ) ) {
153
				$used_ids[ $field_id ] = 0;
154 5
			} else {
155
				$index = ++$used_ids[ $field_id ];
156
			}
157
158
			if ( $index ) {
159
				/**
160
				 * Modify non-unique IDs (custom, id, etc.) to be unique and not gobbled up.
161
				 */
162
				$field_id = sprintf( '%s(%d)', $field_id, $index + 1 );
163
			}
164
165
			/**
166 4
			 * @filter `gravityview/api/field/key` Filter the key name in the results for JSON output.
167
			 * @param[in,out] string $field_id The ID. Should be unique or keys will be gobbled up.
168 4
			 * @param \GV\View $view The view.
169 4
			 * @param \GV\Entry $entry The entry.
170 4
			 * @param \WP_REST_Request $request Request object.
171
			 * @param string $context The context (directory, single)
172 4
			 */
173
			$field_id = apply_filters( 'gravityview/api/field/key', $field_id, $view, $entry, $request, $context );
174
175
			if ( ! $class && in_array( $field->ID, array( 'custom' ) ) ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $class of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
176
				/**
177
				 * Custom fields (and perhaps some others) will require rendering as they don't
178
				 * contain an intrinsic value (for custom their value is stored in the view and requires a renderer).
179
				 * We force the CSV template to take over in such cases, it's good enough for most cases.
180
				 */
181
				$return[ $field_id ] = $renderer->render( $field, $view, $source, $entry, $r, '\GV\Field_CSV_Template' );
182
			} else if ( $class ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $class of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
183
				$return[ $field_id ] = $renderer->render( $field, $view, $source, $entry, $r, $class );
184
			} else {
185
				$return[ $field_id ] = $field->get_value( $view, $source, $entry, $r );
186
			}
187
		}
188 4
189
		return $return;
190 4
	}
191
192 1
	/**
193 1
	 * Get entries from a view
194
	 *
195
	 * Callback for /v1/views/{id}/entries/
196 1
	 *
197 1
	 * @since 2.0
198 1
	 * @param \WP_REST_Request $request Full data about the request.
199 1
	 * @return \WP_Error|\WP_REST_Response
200
	 */
201 1
	public function get_sub_items( $request ) {
202
203
		$url     = $request->get_url_params();
204
		$view_id = intval( $url['id'] );
205
		$format  = \GV\Utils::get( $url, 'format', 'json' );
206
207
		if( $post_id = $request->get_param('post_id') ) {
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
Coding Style introduced by
Expected 1 spaces before closing bracket; 0 found
Loading history...
208
			global $post;
0 ignored issues
show
Compatibility Best Practice introduced by
Use of global functionality is not recommended; it makes your code harder to test, and less reusable.

Instead of relying on global state, we recommend one of these alternatives:

1. Pass all data via parameters

function myFunction($a, $b) {
    // Do something
}

2. Create a class that maintains your state

class MyClass {
    private $a;
    private $b;

    public function __construct($a, $b) {
        $this->a = $a;
        $this->b = $b;
    }

    public function myFunction() {
        // Do something
    }
}
Loading history...
209
210
			$post = get_post( $post_id );
0 ignored issues
show
introduced by
Overridding WordPress globals is prohibited
Loading history...
211
212 1
			if ( ! $post || is_wp_error( $post ) ) {
213
				return new \WP_Error( 'gravityview-post-not-found', sprintf( 'A post with ID #%d was not found.', $post_id ) );
214 1
			}
215 1
216 1
			$collection = \GV\View_Collection::from_post( $post );
217
218
			if ( ! $collection->contains( $view_id ) ) {
219 1
				return new \WP_Error( 'gravityview-post-not-contains', sprintf( 'The post with ID #%d does not contain a View with ID #%d', $post_id, $view_id ) );
220 1
			}
221 1
		}
222
223 1
		$view = \GV\View::by_id( $view_id );
224
225
		if ( 'html' === $format ) {
226 4
227
			$renderer = new \GV\View_Renderer();
228 4
			$count = $total = 0;
229
230
			/** @var \GV\Template_Context $context */
231
			add_action( 'gravityview/template/view/render', function( $context ) use ( &$count, &$total ) {
232 4
				$count = $context->entries->count();
233 2
				$total = $context->entries->total();
234
			} );
235 2
236
			$output = $renderer->render( $view, new Request( $request ) );
237
238 2
			/**
239 2
			 * @filter `gravityview/rest/entries/html/insert_meta` Whether to include `http-equiv` meta tags in the HTML output describing the data
240
			 * @since 2.0
241
			 * @param bool $insert_meta Add <meta> tags? [Default: true]
242 2
			 * @param int $count The number of entries being rendered
243
			 * @param \GV\View $view The view.
244 2
			 * @param \WP_REST_Request $request Request object.
245 2
			 * @param int $total The number of total entries for the request
246
			 */
247 2
			$insert_meta = apply_filters( 'gravityview/rest/entries/html/insert_meta', true, $count, $view, $request, $total );
248 2
249
			if ( $insert_meta ) {
250
				$output = '<meta http-equiv="X-Item-Count" content="' . $count . '" />' . $output;
251 2
				$output = '<meta http-equiv="X-Item-Total" content="' . $total . '" />' . $output;
252
			}
253
254 2
			$response = new \WP_REST_Response( $output, 200 );
255 2
			$response->header( 'X-Item-Count', $count );
256 2
			$response->header( 'X-Item-Total', $total );
257
258 2
			return $response;
259
		}
260
261 3
		$entries = $view->get_entries( new Request( $request ) );
262
263 3
		if ( ! $entries->all() ) {
264 3
			return new \WP_Error( 'gravityview-no-entries', __( 'No Entries found.', 'gravityview' ) );
265
		}
266
267 3
		if ( 'csv' === $format ) {
268
			ob_start();
269
270
			$csv = fopen( 'php://output', 'w' );
271
272
			/** Da' BOM :) */
273
			if ( apply_filters( 'gform_include_bom_export_entries', true, $view->form ? $view->form->form : null ) ) {
274
				fputs( $csv, "\xef\xbb\xbf" );
0 ignored issues
show
introduced by
Filesystem writes are forbidden, you should not be using fputs()
Loading history...
275
			}
276
277
			$headers_done = false;
278
279
			foreach ( $entries->all() as $entry ) {
280 2
				$entry = $this->prepare_entry_for_response( $view, $entry, $request, 'directory', '\GV\Field_CSV_Template' );
281 2
282 2
				if ( ! $headers_done ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $headers_done of type false|integer is loosely compared to false; this is ambiguous if the integer can be zero. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For integer values, zero is a special case, in particular the following results might be unexpected:

0   == false // true
0   == null  // true
123 == false // false
123 == null  // false

// It is often better to use strict comparison
0 === false // false
0 === null  // false
Loading history...
283 2
					$headers_done = fputcsv( $csv, array_map( array( '\GV\Utils', 'strip_excel_formulas' ), array_keys( $entry ) ) );
0 ignored issues
show
introduced by
Filesystem writes are forbidden, you should not be using fputcsv()
Loading history...
284 2
				}
285
286 2
				fputcsv( $csv, array_map( array( '\GV\Utils', 'strip_excel_formulas' ), $entry ) );
0 ignored issues
show
introduced by
Filesystem writes are forbidden, you should not be using fputcsv()
Loading history...
287 2
			}
288
289 2
			$response = new \WP_REST_Response( '', 200 );
290 1
			$response->header( 'X-Item-Count', $entries->count() );
291 1
			$response->header( 'X-Item-Total', $entries->total() );
292
			$response->header( 'Content-Type', 'text/csv' );
293
294 2
			fflush( $csv );
295
296
			echo rtrim( ob_get_clean() );
0 ignored issues
show
introduced by
Expected a sanitizing function (see Codex for 'Data Validation'), but instead saw 'rtrim'
Loading history...
297
298
			add_filter( 'rest_pre_serve_request', '__return_true' );
299
300
			return $response;
301
		}
302
303
		$data = array( 'entries' => $entries->all(), 'total' => $entries->total() );
304
305 4
		foreach ( $data['entries'] as &$entry ) {
306 4
			$entry = $this->prepare_entry_for_response( $view, $entry, $request, 'directory' );
307
		}
308 1
309
		return new \WP_REST_Response( $data, 200 );
310
	}
311 4
312
	/**
313 4
	 * Get one entry from view
314
	 *
315
	 * Callback for /v1/views/{id}/entries/{id}/
316 4
	 *
317
	 * @uses GVCommon::get_entry
318 4
	 * @since 2.0
319
	 * @param \WP_REST_Request $request Full data about the request.
320 4
	 * @return \WP_Error|\WP_REST_Response
321
	 */
322 4
	public function get_sub_item( $request ) {
323
		$url      = $request->get_url_params();
324 4
		$view_id  = intval( $url['id'] );
325 4
		$entry_id = intval( $url['s_id'] );
326
		$format   = \GV\Utils::get( $url, 'format', 'json' );
327 4
328 4
		$view  = \GV\View::by_id( $view_id );
329 4
		$entry = \GV\GF_Entry::by_id( $entry_id );
330 4
331 4
		if ( $format === 'html' ) {
0 ignored issues
show
introduced by
Found "=== '". Use Yoda Condition checks, you must
Loading history...
332
			$renderer = new \GV\Entry_Renderer();
333
			return $renderer->render( $entry, $view, new Request( $request ) );
334 4
		}
335
336
		return $this->prepare_entry_for_response( $view, $entry, $request, 'single' );
337 4
	}
338 4
339 4
	/**
340
	 * Prepare the item for the REST response
341
	 *
342 4
	 * @since 2.0
343 4
	 * @param \WP_Post $view_post WordPress representation of the item.
344
	 * @param \WP_REST_Request $request Request object.
345
	 * @return mixed
346 4
	 */
347
	public function prepare_view_for_response( $view_post, \WP_REST_Request $request ) {
348
		if ( is_wp_error( $this->get_item_permissions_check( $request, $view_post->ID ) ) ) {
349
			// Redacted out view.
350
			return array( 'ID' => $view_post->ID, 'post_content' => __( 'You are not allowed to access this content.', 'gravityview' ) );
351
		}
352
353
		$view = \GV\View::from_post( $view_post );
354 6
355 6
		$item = $view->as_data();
356 4
357
		// Add all the WP_Post data
358 5
		$view_post = $view_post->to_array();
359 5
360
		unset( $view_post['to_ping'], $view_post['ping_status'], $view_post['pinged'], $view_post['post_type'], $view_post['filter'], $view_post['post_category'], $view_post['tags_input'], $view_post['post_content'], $view_post['post_content_filtered'] );
361
362 6
		$return = wp_parse_args( $item, $view_post );
363
364
		$return['title'] = $return['post_title'];
365
366 6
		$return['settings'] = isset( $return['atts'] ) ? $return['atts'] : array();
367
		unset( $return['atts'], $return['view_id'] );
368 6
369 6
		$return['search_criteria'] = array(
370
			'page_size' => rgars( $return, 'settings/page_size' ),
371
			'sort_field' => rgars( $return, 'settings/sort_field' ),
372 1
			'sort_direction' => rgars( $return, 'settings/sort_direction' ),
373 1
			'offset' => rgars( $return, 'settings/offset' ),
374 1
		);
375 1
376
		unset( $return['settings']['page_size'], $return['settings']['sort_field'], $return['settings']['sort_direction'] );
377
378 1
		// Redact for non-logged ins
379
		if ( ! \GVCommon::has_cap( 'edit_others_gravityviews' ) ) {
380
			unset( $return['settings'] );
381
			unset( $return['search_criteria'] );
382
		}
383
		
384
		if ( ! \GFCommon::current_user_can_any( 'gravityforms_edit_forms' ) ) {
385
			unset( $return['form'] );
386
		}
387
388
		return $return;
389
	}
390
391 6
	/**
392 1
	 * @param \WP_REST_Request $request
393
	 *
394
	 * @return bool|\WP_Error
395 6
	 */
396
	public function get_item_permissions_check( $request ) {
397
		if ( func_num_args() === 2 ) {
0 ignored issues
show
introduced by
Found "=== 2". Use Yoda Condition checks, you must
Loading history...
398 2
			$view_id = func_get_arg( 1 ); // $view_id override
399
		} else {
400 2
			$url     = $request->get_url_params();
401
			$view_id = intval( $url['id'] );
402
		}
403
404 2
		if ( ! $view = \GV\View::by_id( $view_id ) ) {
405 2
			return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to access this content.', 'gravityview' ) );
406 2
		}
407
408 2
		while ( $error = $view->can_render( array( 'rest' ), $request ) ) {
409
410 2
			if ( ! is_wp_error( $error ) ) {
411
				break;
412
			}
413
414 2
			switch ( str_replace( 'gravityview/', '', $error->get_error_code() ) ) {
415
				case 'rest_disabled':
416
				case 'post_password_required':
417
				case 'not_public':
418 2
				case 'embed_only':
419
				case 'no_direct_access':
420
					return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to access this content.', 'gravityview' ) );
421
				case 'no_form_attached':
422 2
					return new \WP_Error( 'rest_forbidden', __( 'This View is not configured properly.', 'gravityview' ) );
423
				default:
424
					return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to access this content.', 'gravityview' ) );
425
			}
426 2
		}
427
428 2
		/**
429 1
		 * @filter `gravityview/view/output/rest` Disable rest output. Final chance.
430 1
		 * @param[in,out] bool Enable or not.
431
		 * @param \GV\View $view The view.
432
		 */
433
		if ( ! apply_filters( 'gravityview/view/output/rest', true, $view ) ) {
434 2
			return new \WP_Error( 'rest_forbidden', __( 'You are not allowed to access this content.', 'gravityview' ) );
435
		}
436
437 4
		return true;
438
	}
439 4
440
	public function get_sub_item_permissions_check( $request ) {
441
		// Accessing a single entry needs the View access permissions.
442 4
		if ( is_wp_error( $error = $this->get_items_permissions_check( $request ) ) ) {
443
			return $error;
444 4
		}
445
446
		$url     = $request->get_url_params();
447
		$view_id = intval( $url['id'] );
448
		$entry_id = intval( $url['s_id'] );
449
450
		$view = \GV\View::by_id( $view_id );
451
452
		if ( ! $entry = \GV\GF_Entry::by_id( $entry_id ) ) {
453
			return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
454
		}
455
456
		if ( $entry['form_id'] != $view->form->ID ) {
457
			return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
458
		}
459
460
		if ( $entry['status'] != 'active' ) {
0 ignored issues
show
introduced by
Found "!= '". Use Yoda Condition checks, you must
Loading history...
461
			return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
462
		}
463
464
		if ( apply_filters( 'gravityview_custom_entry_slug', false ) && $entry->slug != get_query_var( \GV\Entry::get_endpoint_name() ) ) {
465
			return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
466
		}
467
468
		$is_admin_and_can_view = $view->settings->get( 'admin_show_all_statuses' ) && \GVCommon::has_cap('gravityview_moderate_entries', $view->ID );
0 ignored issues
show
Coding Style introduced by
Expected 1 spaces after opening bracket; 0 found
Loading history...
469
470
		if ( $view->settings->get( 'show_only_approved' ) && ! $is_admin_and_can_view ) {
471
			if ( ! \GravityView_Entry_Approval_Status::is_approved( gform_get_meta( $entry->ID, \GravityView_Entry_Approval::meta_key ) )  ) {
472
				return new \WP_Error( 'rest_forbidden', 'You are not allowed to view this content.', 'gravityview' );
473
			}
474
		}
475
476
		return true;
477
	}
478
479
	public function get_items_permissions_check( $request ) {
480
		// Getting a list of all Views is always possible.
481
		return true;
482
	}
483
484
	public function get_sub_items_permissions_check( $request ) {
485
		// Accessing all entries of a View needs the same permissions as accessing the View.
486
		return $this->get_item_permissions_check( $request );
487
	}
488
}
489