class-wp-rest-autosaves-controller.php 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463
  1. <?php
  2. /**
  3. * REST API: WP_REST_Autosaves_Controller class.
  4. *
  5. * @package WordPress
  6. * @subpackage REST_API
  7. * @since 5.0.0
  8. */
  9. /**
  10. * Core class used to access autosaves via the REST API.
  11. *
  12. * @since 5.0.0
  13. *
  14. * @see WP_REST_Revisions_Controller
  15. * @see WP_REST_Controller
  16. */
  17. class WP_REST_Autosaves_Controller extends WP_REST_Revisions_Controller {
  18. /**
  19. * Parent post type.
  20. *
  21. * @since 5.0.0
  22. * @var string
  23. */
  24. private $parent_post_type;
  25. /**
  26. * Parent post controller.
  27. *
  28. * @since 5.0.0
  29. * @var WP_REST_Controller
  30. */
  31. private $parent_controller;
  32. /**
  33. * Revision controller.
  34. *
  35. * @since 5.0.0
  36. * @var WP_REST_Revisions_Controller
  37. */
  38. private $revisions_controller;
  39. /**
  40. * The base of the parent controller's route.
  41. *
  42. * @since 5.0.0
  43. * @var string
  44. */
  45. private $parent_base;
  46. /**
  47. * Constructor.
  48. *
  49. * @since 5.0.0
  50. *
  51. * @param string $parent_post_type Post type of the parent.
  52. */
  53. public function __construct( $parent_post_type ) {
  54. $this->parent_post_type = $parent_post_type;
  55. $post_type_object = get_post_type_object( $parent_post_type );
  56. $parent_controller = $post_type_object->get_rest_controller();
  57. if ( ! $parent_controller ) {
  58. $parent_controller = new WP_REST_Posts_Controller( $parent_post_type );
  59. }
  60. $this->parent_controller = $parent_controller;
  61. $this->revisions_controller = new WP_REST_Revisions_Controller( $parent_post_type );
  62. $this->rest_base = 'autosaves';
  63. $this->namespace = ! empty( $post_type_object->rest_namespace ) ? $post_type_object->rest_namespace : 'wp/v2';
  64. $this->parent_base = ! empty( $post_type_object->rest_base ) ? $post_type_object->rest_base : $post_type_object->name;
  65. }
  66. /**
  67. * Registers the routes for autosaves.
  68. *
  69. * @since 5.0.0
  70. *
  71. * @see register_rest_route()
  72. */
  73. public function register_routes() {
  74. register_rest_route(
  75. $this->namespace,
  76. '/' . $this->parent_base . '/(?P<id>[\d]+)/' . $this->rest_base,
  77. array(
  78. 'args' => array(
  79. 'parent' => array(
  80. 'description' => __( 'The ID for the parent of the autosave.' ),
  81. 'type' => 'integer',
  82. ),
  83. ),
  84. array(
  85. 'methods' => WP_REST_Server::READABLE,
  86. 'callback' => array( $this, 'get_items' ),
  87. 'permission_callback' => array( $this, 'get_items_permissions_check' ),
  88. 'args' => $this->get_collection_params(),
  89. ),
  90. array(
  91. 'methods' => WP_REST_Server::CREATABLE,
  92. 'callback' => array( $this, 'create_item' ),
  93. 'permission_callback' => array( $this, 'create_item_permissions_check' ),
  94. 'args' => $this->parent_controller->get_endpoint_args_for_item_schema( WP_REST_Server::EDITABLE ),
  95. ),
  96. 'schema' => array( $this, 'get_public_item_schema' ),
  97. )
  98. );
  99. register_rest_route(
  100. $this->namespace,
  101. '/' . $this->parent_base . '/(?P<parent>[\d]+)/' . $this->rest_base . '/(?P<id>[\d]+)',
  102. array(
  103. 'args' => array(
  104. 'parent' => array(
  105. 'description' => __( 'The ID for the parent of the autosave.' ),
  106. 'type' => 'integer',
  107. ),
  108. 'id' => array(
  109. 'description' => __( 'The ID for the autosave.' ),
  110. 'type' => 'integer',
  111. ),
  112. ),
  113. array(
  114. 'methods' => WP_REST_Server::READABLE,
  115. 'callback' => array( $this, 'get_item' ),
  116. 'permission_callback' => array( $this->revisions_controller, 'get_item_permissions_check' ),
  117. 'args' => array(
  118. 'context' => $this->get_context_param( array( 'default' => 'view' ) ),
  119. ),
  120. ),
  121. 'schema' => array( $this, 'get_public_item_schema' ),
  122. )
  123. );
  124. }
  125. /**
  126. * Get the parent post.
  127. *
  128. * @since 5.0.0
  129. *
  130. * @param int $parent_id Supplied ID.
  131. * @return WP_Post|WP_Error Post object if ID is valid, WP_Error otherwise.
  132. */
  133. protected function get_parent( $parent_id ) {
  134. return $this->revisions_controller->get_parent( $parent_id );
  135. }
  136. /**
  137. * Checks if a given request has access to get autosaves.
  138. *
  139. * @since 5.0.0
  140. *
  141. * @param WP_REST_Request $request Full details about the request.
  142. * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
  143. */
  144. public function get_items_permissions_check( $request ) {
  145. $parent = $this->get_parent( $request['id'] );
  146. if ( is_wp_error( $parent ) ) {
  147. return $parent;
  148. }
  149. if ( ! current_user_can( 'edit_post', $parent->ID ) ) {
  150. return new WP_Error(
  151. 'rest_cannot_read',
  152. __( 'Sorry, you are not allowed to view autosaves of this post.' ),
  153. array( 'status' => rest_authorization_required_code() )
  154. );
  155. }
  156. return true;
  157. }
  158. /**
  159. * Checks if a given request has access to create an autosave revision.
  160. *
  161. * Autosave revisions inherit permissions from the parent post,
  162. * check if the current user has permission to edit the post.
  163. *
  164. * @since 5.0.0
  165. *
  166. * @param WP_REST_Request $request Full details about the request.
  167. * @return true|WP_Error True if the request has access to create the item, WP_Error object otherwise.
  168. */
  169. public function create_item_permissions_check( $request ) {
  170. $id = $request->get_param( 'id' );
  171. if ( empty( $id ) ) {
  172. return new WP_Error(
  173. 'rest_post_invalid_id',
  174. __( 'Invalid item ID.' ),
  175. array( 'status' => 404 )
  176. );
  177. }
  178. return $this->parent_controller->update_item_permissions_check( $request );
  179. }
  180. /**
  181. * Creates, updates or deletes an autosave revision.
  182. *
  183. * @since 5.0.0
  184. *
  185. * @param WP_REST_Request $request Full details about the request.
  186. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  187. */
  188. public function create_item( $request ) {
  189. if ( ! defined( 'DOING_AUTOSAVE' ) ) {
  190. define( 'DOING_AUTOSAVE', true );
  191. }
  192. $post = get_post( $request['id'] );
  193. if ( is_wp_error( $post ) ) {
  194. return $post;
  195. }
  196. $prepared_post = $this->parent_controller->prepare_item_for_database( $request );
  197. $prepared_post->ID = $post->ID;
  198. $user_id = get_current_user_id();
  199. // We need to check post lock to ensure the original author didn't leave their browser tab open.
  200. if ( ! function_exists( 'wp_check_post_lock' ) ) {
  201. require_once ABSPATH . 'wp-admin/includes/post.php';
  202. }
  203. $post_lock = wp_check_post_lock( $post->ID );
  204. $is_draft = 'draft' === $post->post_status || 'auto-draft' === $post->post_status;
  205. if ( $is_draft && (int) $post->post_author === $user_id && ! $post_lock ) {
  206. // Draft posts for the same author: autosaving updates the post and does not create a revision.
  207. // Convert the post object to an array and add slashes, wp_update_post() expects escaped array.
  208. $autosave_id = wp_update_post( wp_slash( (array) $prepared_post ), true );
  209. } else {
  210. // Non-draft posts: create or update the post autosave.
  211. $autosave_id = $this->create_post_autosave( (array) $prepared_post );
  212. }
  213. if ( is_wp_error( $autosave_id ) ) {
  214. return $autosave_id;
  215. }
  216. $autosave = get_post( $autosave_id );
  217. $request->set_param( 'context', 'edit' );
  218. $response = $this->prepare_item_for_response( $autosave, $request );
  219. $response = rest_ensure_response( $response );
  220. return $response;
  221. }
  222. /**
  223. * Get the autosave, if the ID is valid.
  224. *
  225. * @since 5.0.0
  226. *
  227. * @param WP_REST_Request $request Full details about the request.
  228. * @return WP_Post|WP_Error Revision post object if ID is valid, WP_Error otherwise.
  229. */
  230. public function get_item( $request ) {
  231. $parent_id = (int) $request->get_param( 'parent' );
  232. if ( $parent_id <= 0 ) {
  233. return new WP_Error(
  234. 'rest_post_invalid_id',
  235. __( 'Invalid post parent ID.' ),
  236. array( 'status' => 404 )
  237. );
  238. }
  239. $autosave = wp_get_post_autosave( $parent_id );
  240. if ( ! $autosave ) {
  241. return new WP_Error(
  242. 'rest_post_no_autosave',
  243. __( 'There is no autosave revision for this post.' ),
  244. array( 'status' => 404 )
  245. );
  246. }
  247. $response = $this->prepare_item_for_response( $autosave, $request );
  248. return $response;
  249. }
  250. /**
  251. * Gets a collection of autosaves using wp_get_post_autosave.
  252. *
  253. * Contains the user's autosave, for empty if it doesn't exist.
  254. *
  255. * @since 5.0.0
  256. *
  257. * @param WP_REST_Request $request Full details about the request.
  258. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  259. */
  260. public function get_items( $request ) {
  261. $parent = $this->get_parent( $request['id'] );
  262. if ( is_wp_error( $parent ) ) {
  263. return $parent;
  264. }
  265. $response = array();
  266. $parent_id = $parent->ID;
  267. $revisions = wp_get_post_revisions( $parent_id, array( 'check_enabled' => false ) );
  268. foreach ( $revisions as $revision ) {
  269. if ( false !== strpos( $revision->post_name, "{$parent_id}-autosave" ) ) {
  270. $data = $this->prepare_item_for_response( $revision, $request );
  271. $response[] = $this->prepare_response_for_collection( $data );
  272. }
  273. }
  274. return rest_ensure_response( $response );
  275. }
  276. /**
  277. * Retrieves the autosave's schema, conforming to JSON Schema.
  278. *
  279. * @since 5.0.0
  280. *
  281. * @return array Item schema data.
  282. */
  283. public function get_item_schema() {
  284. if ( $this->schema ) {
  285. return $this->add_additional_fields_schema( $this->schema );
  286. }
  287. $schema = $this->revisions_controller->get_item_schema();
  288. $schema['properties']['preview_link'] = array(
  289. 'description' => __( 'Preview link for the post.' ),
  290. 'type' => 'string',
  291. 'format' => 'uri',
  292. 'context' => array( 'edit' ),
  293. 'readonly' => true,
  294. );
  295. $this->schema = $schema;
  296. return $this->add_additional_fields_schema( $this->schema );
  297. }
  298. /**
  299. * Creates autosave for the specified post.
  300. *
  301. * From wp-admin/post.php.
  302. *
  303. * @since 5.0.0
  304. *
  305. * @param array $post_data Associative array containing the post data.
  306. * @return mixed The autosave revision ID or WP_Error.
  307. */
  308. public function create_post_autosave( $post_data ) {
  309. $post_id = (int) $post_data['ID'];
  310. $post = get_post( $post_id );
  311. if ( is_wp_error( $post ) ) {
  312. return $post;
  313. }
  314. $user_id = get_current_user_id();
  315. // Store one autosave per author. If there is already an autosave, overwrite it.
  316. $old_autosave = wp_get_post_autosave( $post_id, $user_id );
  317. if ( $old_autosave ) {
  318. $new_autosave = _wp_post_revision_data( $post_data, true );
  319. $new_autosave['ID'] = $old_autosave->ID;
  320. $new_autosave['post_author'] = $user_id;
  321. // If the new autosave has the same content as the post, delete the autosave.
  322. $autosave_is_different = false;
  323. foreach ( array_intersect( array_keys( $new_autosave ), array_keys( _wp_post_revision_fields( $post ) ) ) as $field ) {
  324. if ( normalize_whitespace( $new_autosave[ $field ] ) !== normalize_whitespace( $post->$field ) ) {
  325. $autosave_is_different = true;
  326. break;
  327. }
  328. }
  329. if ( ! $autosave_is_different ) {
  330. wp_delete_post_revision( $old_autosave->ID );
  331. return new WP_Error(
  332. 'rest_autosave_no_changes',
  333. __( 'There is nothing to save. The autosave and the post content are the same.' ),
  334. array( 'status' => 400 )
  335. );
  336. }
  337. /** This filter is documented in wp-admin/post.php */
  338. do_action( 'wp_creating_autosave', $new_autosave );
  339. // wp_update_post() expects escaped array.
  340. return wp_update_post( wp_slash( $new_autosave ) );
  341. }
  342. // Create the new autosave as a special post revision.
  343. return _wp_put_post_revision( $post_data, true );
  344. }
  345. /**
  346. * Prepares the revision for the REST response.
  347. *
  348. * @since 5.0.0
  349. * @since 5.9.0 Renamed `$post` to `$item` to match parent class for PHP 8 named parameter support.
  350. *
  351. * @param WP_Post $item Post revision object.
  352. * @param WP_REST_Request $request Request object.
  353. * @return WP_REST_Response Response object.
  354. */
  355. public function prepare_item_for_response( $item, $request ) {
  356. // Restores the more descriptive, specific name for use within this method.
  357. $post = $item;
  358. $response = $this->revisions_controller->prepare_item_for_response( $post, $request );
  359. $fields = $this->get_fields_for_response( $request );
  360. if ( in_array( 'preview_link', $fields, true ) ) {
  361. $parent_id = wp_is_post_autosave( $post );
  362. $preview_post_id = false === $parent_id ? $post->ID : $parent_id;
  363. $preview_query_args = array();
  364. if ( false !== $parent_id ) {
  365. $preview_query_args['preview_id'] = $parent_id;
  366. $preview_query_args['preview_nonce'] = wp_create_nonce( 'post_preview_' . $parent_id );
  367. }
  368. $response->data['preview_link'] = get_preview_post_link( $preview_post_id, $preview_query_args );
  369. }
  370. $context = ! empty( $request['context'] ) ? $request['context'] : 'view';
  371. $response->data = $this->add_additional_fields_to_object( $response->data, $request );
  372. $response->data = $this->filter_response_by_context( $response->data, $context );
  373. /**
  374. * Filters a revision returned from the REST API.
  375. *
  376. * Allows modification of the revision right before it is returned.
  377. *
  378. * @since 5.0.0
  379. *
  380. * @param WP_REST_Response $response The response object.
  381. * @param WP_Post $post The original revision object.
  382. * @param WP_REST_Request $request Request used to generate the response.
  383. */
  384. return apply_filters( 'rest_prepare_autosave', $response, $post, $request );
  385. }
  386. /**
  387. * Retrieves the query params for the autosaves collection.
  388. *
  389. * @since 5.0.0
  390. *
  391. * @return array Collection parameters.
  392. */
  393. public function get_collection_params() {
  394. return array(
  395. 'context' => $this->get_context_param( array( 'default' => 'view' ) ),
  396. );
  397. }
  398. }