tabulate / tabulate

src/Controllers/RecordController.php

<?php
/**
 * This file contains only a single class.
 *
 * @package Tabulate
 * @file
 */

namespace WordPress\Tabulate\Controllers;

use WordPress\Tabulate\DB\Grants;

/**
 * This controller handles viewing, saving, and deleting of individual Records.
 */
class RecordController extends ControllerBase {

	/**
	 * Get the record-editing template for the given table.
	 *
	 * @param \WordPress\Tabulate\DB\Table $table The table.
	 * @return \WordPress\Tabulate\Template
	 */
	private function get_template( $table ) {
		$template = new \WordPress\Tabulate\Template( 'record/admin.html' );
		$template->table = $table;
		$template->controller = 'record';
		return $template;
	}

	/**
	 * Show the record-editing form.
	 *
	 * @param string $args The request arguments.
	 * @return string
	 */
	public function index( $args ) {
		// Get database and table.
		$db = new \WordPress\Tabulate\DB\Database( $this->wpdb );
		$table = $db->get_table( $args['table'] );

		// Give it all to the template.
		$template = $this->get_template( $table );
		if ( isset( $args['ident'] ) ) {
			$template->record = $table->get_record( $args['ident'] );
			// Check permission.
			if ( ! Grants::current_user_can( Grants::UPDATE, $table->get_name() ) ) {
				$template->add_notice( 'error', 'You do not have permission to update data in this table.' );
			}
		}
		if ( ! isset( $template->record ) || false === $template->record ) {
			$template->record = $table->get_default_record();
			// Check permission.
			if ( ! Grants::current_user_can( Grants::CREATE, $table->get_name() ) ) {
				$template->add_notice( 'error', 'You do not have permission to create records in this table.' );
			}
			// Add query-string values.
			if ( isset( $args['defaults'] ) ) {
				$template->record->set_multiple( $args['defaults'] );
			}
		}
		// Don't save to non-updatable views.
		if ( ! $table->is_updatable() ) {
			$template->add_notice( 'error', "This table can not be updated." );
		}

		// Enable postboxes (for the history and related tables' boxen).
		wp_enqueue_script( 'dashboard' );

		// Return to URL.
		if ( isset( $args['return_to'] ) ) {
			$template->return_to = $args['return_to'];
		}

		return $template->render();
	}

	/**
	 * Save a record.
	 *
	 * @param string[] $args The request arguments.
	 * @return boolean
	 */
	public function save( $args ) {
		$db = new \WordPress\Tabulate\DB\Database( $this->wpdb );
		$table = $db->get_table( $args['table'] );
		if ( ! $table ) {
			// It shouldn't be possible to get here via the UI, so no message.
			return false;
		}

		// Guard against non-post requests. c.f. wp-comments-post.php.
		if ( ! isset( $_SERVER['REQUEST_METHOD'] ) || 'POST' !== $_SERVER['REQUEST_METHOD'] ) {
			header( 'Allow: POST' );
			header( 'HTTP/1.1 405 Method Not Allowed' );
			header( 'Content-Type: text/plain' );
			return false;
		}

		$record_ident = isset( $args['ident'] ) ? $args['ident'] : false;
		$this->verify_nonce( 'tabulate-record-' . $record_ident );
		$template = $this->get_template( $table );

		// Make sure we're not saving over an already-existing record.
		$pk_name = $table->get_pk_column()->get_name();
		$pk = $_POST[ $pk_name ];
		$existing = $table->get_record( $pk );
		if ( ! $record_ident && $existing ) {

The expression $record_ident of type string|false is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === false instead.

			$template->add_notice( 'updated', "The record identified by '$pk' already exists." );
			$_REQUEST['return_to'] = $existing->get_url();
		} else {
			// Otherwise, create a new one.
			try {
				$data = wp_unslash( $_POST );
				$this->wpdb->query( 'BEGIN' );
				$template->record = $table->save_record( $data, $record_ident );
				$this->wpdb->query( 'COMMIT' );
				$template->add_notice( 'updated', 'Record saved.' );
			} catch ( \Exception $e ) {
				$template->add_notice( 'error', $e->getMessage() );
				$template->record = new \WordPress\Tabulate\DB\Record( $table, $data );
			}
		}
		// Redirect back to the edit form.
		$return_to = ( ! empty( $_REQUEST['return_to'] ) ) ? $_REQUEST['return_to'] : $template->record->get_url();
		wp_safe_redirect( $return_to );
		exit;
	}

	/**
	 * Delete (or ask for confirmation of deleting) a single record.
	 *
	 * @param string[] $args The request arguments.
	 * @return type
	 */
	public function delete( $args ) {
		$db = new \WordPress\Tabulate\DB\Database( $this->wpdb );
		$table = $db->get_table( $args['table'] );
		$record_ident = isset( $args['ident'] ) ? $args['ident'] : false;
		if ( ! $record_ident ) {

The expression $record_ident of type string|false is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === false instead.

			wp_safe_redirect( $table->get_url() );
			exit;
		}

		// Ask for confirmation.
		if ( ! isset( $_POST['confirm_deletion'] ) ) {
			$template = new \WordPress\Tabulate\Template( 'record/delete.html' );
			$template->table = $table;
			$template->record = $table->get_record( $record_ident );
			return $template->render();
		}

		// Delete the record.
		check_admin_referer( 'tabulate-record-delete-' . $record_ident );
		try {
			$this->wpdb->query( 'BEGIN' );
			$table->delete_record( $record_ident );
			$this->wpdb->query( 'COMMIT' );
		} catch ( \Exception $e ) {
			$template = $this->get_template( $table );
			$template->record = $table->get_record( $record_ident );
			$template->add_notice( 'error', $e->getMessage() );
			return $template->render();
		}

		wp_safe_redirect( $table->get_url() );
		exit;
	}
}