Skip to content

Commit e36ac84

Browse files
sjinkssjinks
committedOct 13, 2021
REST API Enhancements: fix code standards compliance issues
1 parent 9d3bf1e commit e36ac84

File tree

2 files changed

+74
-68
lines changed

2 files changed

+74
-68
lines changed
 

‎rest-api/vip-endpoints.php

+58-54
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
<?php
22
/*
3-
Plugin Name: VIP REST API Endpoints
4-
Plugin URI: https://wpvip.com
5-
Description: Add custom REST API endpoints for VIP requests; N.B. these endpoints are subject to change without notice, and should be considered "private".
6-
Author: Erick Hitter, Automattic
7-
Version: 0.1
8-
*/
3+
Plugin Name: VIP REST API Endpoints
4+
Plugin URI: https://wpvip.com
5+
Description: Add custom REST API endpoints for VIP requests; N.B. these endpoints are subject to change without notice, and should be considered "private".
6+
Author: Erick Hitter, Automattic
7+
Version: 0.1
8+
*/
99

1010
class WPCOM_VIP_REST_API_Endpoints {
1111
/**
1212
* SINGLETON
1313
*/
14-
private static $__instance = null;
14+
private static $instance = null;
1515

1616
public static function instance() {
17-
if ( ! is_a( self::$__instance, __CLASS__ ) ) {
18-
self::$__instance = new self;
17+
if ( ! is_a( self::$instance, __CLASS__ ) ) {
18+
self::$instance = new self();
1919
}
2020

21-
return self::$__instance;
21+
return self::$instance;
2222
}
2323

2424
/**
@@ -80,16 +80,19 @@ public function rest_api_init() {
8080
public function force_authorized_access( $result ) {
8181
global $wp_rewrite;
8282

83+
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
84+
$request_uri = $_SERVER['REQUEST_URI'] ?? '';
85+
8386
if ( $wp_rewrite->using_permalinks() ) {
8487
$rest_prefix = rest_get_url_prefix();
8588

8689
// Expected request.
8790
$expected_namespace = get_rest_url( null, $this->namespace );
8891
$expected_namespace = trailingslashit( $expected_namespace );
89-
$expected_namespace = parse_url( $expected_namespace, PHP_URL_PATH );
92+
$expected_namespace = wp_parse_url( $expected_namespace, PHP_URL_PATH );
9093

9194
// Actual request.
92-
$request_parts = explode( '/', $_SERVER['REQUEST_URI'] );
95+
$request_parts = explode( '/', $request_uri );
9396

9497
// Drop undesirable leading bits to rebuild namespace from request.
9598
foreach ( $request_parts as $key => $part ) {
@@ -111,14 +114,14 @@ public function force_authorized_access( $result ) {
111114
return $result;
112115
}
113116

114-
$slashed_request = trailingslashit( $_SERVER['REQUEST_URI'] );
117+
$slashed_request = trailingslashit( $request_uri );
115118

116119
if ( 0 === strpos( $slashed_request, $expected_namespace ) && wpcom_vip_go_rest_api_request_allowed( $this->namespace ) ) {
117120
return true;
118121
}
119122
} else {
120123
$query_args = array();
121-
$query_string = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_QUERY );
124+
$query_string = wp_parse_url( $request_uri, PHP_URL_QUERY );
122125
wp_parse_str( $query_string, $query_args );
123126

124127
if ( ! isset( $query_args['rest_route'] ) ) {
@@ -159,7 +162,7 @@ public function list_sites() {
159162
foreach ( $_sites as $_site ) {
160163
switch_to_blog( $_site );
161164

162-
$url_parts = wp_parse_args( parse_url( home_url() ), array(
165+
$url_parts = wp_parse_args( wp_parse_url( home_url() ), array(
163166
'host' => '',
164167
'path' => '',
165168
) );
@@ -173,7 +176,7 @@ public function list_sites() {
173176
}
174177

175178
$sites[] = array(
176-
'ID' => $_site,
179+
'ID' => $_site,
177180
'domain_name' => $url,
178181
);
179182

@@ -187,8 +190,8 @@ public function list_sites() {
187190
} else {
188191
// Provided for consistency, even though this provides no insightful response
189192
$sites[] = array(
190-
'ID' => 1,
191-
'domain_name' => parse_url( home_url(), PHP_URL_HOST ),
193+
'ID' => 1,
194+
'domain_name' => wp_parse_url( home_url(), PHP_URL_HOST ),
192195
);
193196
}
194197

@@ -209,7 +212,7 @@ public function list_plugins() {
209212
*
210213
* @return WP_REST_Response
211214
*/
212-
public function list_jetpack_details( $request ): WP_REST_Response {
215+
public function list_jetpack_details(): WP_REST_Response {
213216
$details = [];
214217

215218
if ( is_multisite() ) {
@@ -246,7 +249,7 @@ public function list_jetpack_details( $request ): WP_REST_Response {
246249
*/
247250
protected function get_jetpack_details_for_site(): array {
248251
$connection = new Automattic\Jetpack\Connection\Manager();
249-
$data = [
252+
$data = [
250253
'site_id' => get_current_blog_id(),
251254
'cache_site_id' => Jetpack::get_option( 'id' ),
252255
'home_url' => home_url(),
@@ -269,24 +272,24 @@ protected function get_all_plugins() {
269272

270273
// array of all standard plugins
271274
$standard_plugins = get_plugins();
272-
$tmp_plugins = array();
275+
$tmp_plugins = array();
273276
foreach ( $standard_plugins as $key => $plugin ) {
274277
$vip_plugin_slug = 'plugins/' . dirname( $key );
275278
if ( is_plugin_active( $key ) ) {
276279
$tmp_plugins[ $key ] = array(
277-
'name' => $plugin['Name'],
278-
'version' => $plugin['Version'],
280+
'name' => $plugin['Name'],
281+
'version' => $plugin['Version'],
279282
'description' => $plugin['Description'],
280-
'type' => 'standard',
281-
'active' => true,
283+
'type' => 'standard',
284+
'active' => true,
282285
);
283286
} elseif ( ! in_array( $vip_plugin_slug, $vip_loaded_plugins, true ) ) {
284287
$tmp_plugins[ $key ] = array(
285-
'name' => $plugin['Name'],
286-
'version' => $plugin['Version'],
288+
'name' => $plugin['Name'],
289+
'version' => $plugin['Version'],
287290
'description' => $plugin['Description'],
288-
'type' => 'standard',
289-
'active' => false,
291+
'type' => 'standard',
292+
'active' => false,
290293
);
291294
}
292295
}
@@ -298,71 +301,72 @@ protected function get_all_plugins() {
298301
$vip_plugin_slug = 'plugins/' . dirname( $key );
299302
if ( in_array( $vip_plugin_slug, $vip_loaded_plugins, true ) ) {
300303
$tmp_plugins[ $key ] = array(
301-
'name' => $plugin['Name'],
302-
'version' => $plugin['Version'],
304+
'name' => $plugin['Name'],
305+
'version' => $plugin['Version'],
303306
'description' => $plugin['Description'],
304-
'type' => 'standard-code',
305-
'active' => true,
307+
'type' => 'standard-code',
308+
'active' => true,
306309
);
307310
}
308311
}
309312
$all_plugins['standard-code'] = $tmp_plugins;
310313

311314
// array of all mu plugins
312-
$mu_plugins = get_mu_plugins();
315+
$mu_plugins = get_mu_plugins();
313316
$tmp_plugins = array();
314317
foreach ( $mu_plugins as $key => $plugin ) {
315318
$tmp_plugins[ $key ] = array(
316-
'name' => $plugin['Name'],
317-
'version' => $plugin['Version'],
319+
'name' => $plugin['Name'],
320+
'version' => $plugin['Version'],
318321
'description' => $plugin['Description'],
319-
'type' => 'mu-plugin',
320-
'active' => true,
322+
'type' => 'mu-plugin',
323+
'active' => true,
321324
);
322325
}
323326
$all_plugins['mu-plugin'] = $tmp_plugins;
324327

325328
// array of all client mu plugins
326329
$client_mu_plugins = wpcom_vip_get_client_mu_plugins_data();
327-
$tmp_plugins = array();
330+
$tmp_plugins = array();
328331
foreach ( $client_mu_plugins as $key => $plugin ) {
329332
$tmp_plugins[ $key ] = array(
330-
'name' => $plugin['Name'],
331-
'version' => $plugin['Version'],
333+
'name' => $plugin['Name'],
334+
'version' => $plugin['Version'],
332335
'description' => $plugin['Description'],
333-
'type' => 'client-mu-plugin',
334-
'active' => true,
336+
'type' => 'client-mu-plugin',
337+
'active' => true,
335338
);
336339
}
337340
$all_plugins['client-mu-plugin'] = $tmp_plugins;
338341

339342
// array of all shared plugins (activated via code and via UI)
340343
// once the remaining shared plugins are retired we can remove this section
341-
$tmp_ui_plugins = array();
344+
$tmp_ui_plugins = array();
342345
$tmp_code_plugins = array();
343346
foreach ( get_plugins( '/../mu-plugins/shared-plugins' ) as $key => $plugin ) {
344-
if ( $active_plugin_type = $this->legacy_is_plugin_active( basename( dirname( $key ) ) ) ) {
347+
$active_plugin_type = $this->legacy_is_plugin_active( basename( dirname( $key ) ) );
348+
if ( $active_plugin_type ) {
345349
if ( 'manual' === $active_plugin_type ) {
346350
$tmp_code_plugins[ $key ] = array(
347-
'name' => $plugin['Name'],
348-
'version' => $plugin['Version'],
351+
'name' => $plugin['Name'],
352+
'version' => $plugin['Version'],
349353
'description' => $plugin['Description'],
350-
'type' => 'vip-shared-code',
351-
'active' => true,
354+
'type' => 'vip-shared-code',
355+
'active' => true,
352356
);
353357
} else {
354358
$tmp_ui_plugins[ $key ] = array(
355-
'name' => $plugin['Name'],
356-
'version' => $plugin['Version'],
359+
'name' => $plugin['Name'],
360+
'version' => $plugin['Version'],
357361
'description' => $plugin['Description'],
358-
'type' => 'vip-shared-ui',
359-
'active' => true,
362+
'type' => 'vip-shared-ui',
363+
'active' => true,
360364
);
361365
}
362366
}
363367
}
364368
$all_plugins['vip-shared-code'] = $tmp_code_plugins;
365-
$all_plugins['vip-shared-ui'] = $tmp_ui_plugins;
369+
$all_plugins['vip-shared-ui'] = $tmp_ui_plugins;
366370

367371
// add constant to endpoint
368372
$all_plugins['disable-shared-plugins'] = ( defined( 'WPCOM_VIP_DISABLE_SHARED_PLUGINS' ) && true === WPCOM_VIP_DISABLE_SHARED_PLUGINS ) ? true : false;

‎vip-rest-api.php

+16-14
Original file line numberDiff line numberDiff line change
@@ -71,36 +71,38 @@ function wpcom_vip_verify_go_rest_api_request_authorization( $namespace, $auth_h
7171
function wpcom_vip_go_rest_api_request_allowed( $namespace, $cap = 'do_not_allow' ) {
7272
// First check basic auth
7373
$basic_auth_user = wpcom_vip_basic_auth_user();
74-
if ( $basic_auth_user && ! is_wp_error( $basic_auth_user ) &&
75-
$basic_auth_user->ID && $basic_auth_user->ID > 0 ) {
76-
$user_id = $basic_auth_user->ID;
77-
78-
// Check current user has `vip_support` or the required capability.
79-
// VIP Support users should be able to do anything on the site, but
80-
// this cap check runs before that plugin is loaded.
81-
// https://github.com/Automattic/vip-support
82-
if ( user_can( $user_id, 'vip_support' ) || user_can( $user_id, $cap ) ) {
83-
return true;
84-
}
74+
if ( $basic_auth_user && ! is_wp_error( $basic_auth_user ) && $basic_auth_user->ID && $basic_auth_user->ID > 0 ) {
75+
$user_id = $basic_auth_user->ID;
76+
77+
// Check current user has `vip_support` or the required capability.
78+
// VIP Support users should be able to do anything on the site, but
79+
// this cap check runs before that plugin is loaded.
80+
// https://github.com/Automattic/vip-support
81+
if ( user_can( $user_id, 'vip_support' ) || user_can( $user_id, $cap ) ) {
82+
return true;
83+
}
8584
}
8685

8786
// Do we have a header to check?
88-
if ( ! isset( $_SERVER['HTTP_AUTHORIZATION'] ) || empty( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
87+
if ( empty( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
8988
return false;
9089
}
9190

91+
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
9292
return wpcom_vip_verify_go_rest_api_request_authorization( $namespace, $_SERVER['HTTP_AUTHORIZATION'] );
9393
}
9494

9595
function wpcom_vip_basic_auth_user() {
96+
// phpcs:disable WordPressVIPMinimum.Variables.ServerVariables.BasicAuthentication
9697
if ( ! isset( $_SERVER['PHP_AUTH_USER'] ) || ! isset( $_SERVER['PHP_AUTH_PW'] ) ) {
9798
return false;
9899
}
99100

100-
$username = $_SERVER['PHP_AUTH_USER'];
101-
$password = $_SERVER['PHP_AUTH_PW'];
101+
$username = $_SERVER['PHP_AUTH_USER']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
102+
$password = $_SERVER['PHP_AUTH_PW']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
102103

103104
return wp_authenticate( $username, $password );
105+
// phpcs:enable
104106
}
105107

106108
/**

0 commit comments

Comments
 (0)
Please sign in to comment.