class-wp-rest-plugins-controller.php 28 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004
  1. <?php
  2. /**
  3. * REST API: WP_REST_Plugins_Controller class
  4. *
  5. * @package WordPress
  6. * @subpackage REST_API
  7. * @since 5.5.0
  8. */
  9. /**
  10. * Core class to access plugins via the REST API.
  11. *
  12. * @since 5.5.0
  13. *
  14. * @see WP_REST_Controller
  15. */
  16. class WP_REST_Plugins_Controller extends WP_REST_Controller {
  17. const PATTERN = '[^.\/]+(?:\/[^.\/]+)?';
  18. /**
  19. * Plugins controller constructor.
  20. *
  21. * @since 5.5.0
  22. */
  23. public function __construct() {
  24. $this->namespace = 'wp/v2';
  25. $this->rest_base = 'plugins';
  26. }
  27. /**
  28. * Registers the routes for the plugins controller.
  29. *
  30. * @since 5.5.0
  31. */
  32. public function register_routes() {
  33. register_rest_route(
  34. $this->namespace,
  35. '/' . $this->rest_base,
  36. array(
  37. array(
  38. 'methods' => WP_REST_Server::READABLE,
  39. 'callback' => array( $this, 'get_items' ),
  40. 'permission_callback' => array( $this, 'get_items_permissions_check' ),
  41. 'args' => $this->get_collection_params(),
  42. ),
  43. array(
  44. 'methods' => WP_REST_Server::CREATABLE,
  45. 'callback' => array( $this, 'create_item' ),
  46. 'permission_callback' => array( $this, 'create_item_permissions_check' ),
  47. 'args' => array(
  48. 'slug' => array(
  49. 'type' => 'string',
  50. 'required' => true,
  51. 'description' => __( 'WordPress.org plugin directory slug.' ),
  52. 'pattern' => '[\w\-]+',
  53. ),
  54. 'status' => array(
  55. 'description' => __( 'The plugin activation status.' ),
  56. 'type' => 'string',
  57. 'enum' => is_multisite() ? array( 'inactive', 'active', 'network-active' ) : array( 'inactive', 'active' ),
  58. 'default' => 'inactive',
  59. ),
  60. ),
  61. ),
  62. 'schema' => array( $this, 'get_public_item_schema' ),
  63. )
  64. );
  65. register_rest_route(
  66. $this->namespace,
  67. '/' . $this->rest_base . '/(?P<plugin>' . self::PATTERN . ')',
  68. array(
  69. array(
  70. 'methods' => WP_REST_Server::READABLE,
  71. 'callback' => array( $this, 'get_item' ),
  72. 'permission_callback' => array( $this, 'get_item_permissions_check' ),
  73. ),
  74. array(
  75. 'methods' => WP_REST_Server::EDITABLE,
  76. 'callback' => array( $this, 'update_item' ),
  77. 'permission_callback' => array( $this, 'update_item_permissions_check' ),
  78. 'args' => $this->get_endpoint_args_for_item_schema( WP_REST_Server::EDITABLE ),
  79. ),
  80. array(
  81. 'methods' => WP_REST_Server::DELETABLE,
  82. 'callback' => array( $this, 'delete_item' ),
  83. 'permission_callback' => array( $this, 'delete_item_permissions_check' ),
  84. ),
  85. 'args' => array(
  86. 'context' => $this->get_context_param( array( 'default' => 'view' ) ),
  87. 'plugin' => array(
  88. 'type' => 'string',
  89. 'pattern' => self::PATTERN,
  90. 'validate_callback' => array( $this, 'validate_plugin_param' ),
  91. 'sanitize_callback' => array( $this, 'sanitize_plugin_param' ),
  92. ),
  93. ),
  94. 'schema' => array( $this, 'get_public_item_schema' ),
  95. )
  96. );
  97. }
  98. /**
  99. * Checks if a given request has access to get plugins.
  100. *
  101. * @since 5.5.0
  102. *
  103. * @param WP_REST_Request $request Full details about the request.
  104. * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
  105. */
  106. public function get_items_permissions_check( $request ) {
  107. if ( ! current_user_can( 'activate_plugins' ) ) {
  108. return new WP_Error(
  109. 'rest_cannot_view_plugins',
  110. __( 'Sorry, you are not allowed to manage plugins for this site.' ),
  111. array( 'status' => rest_authorization_required_code() )
  112. );
  113. }
  114. return true;
  115. }
  116. /**
  117. * Retrieves a collection of plugins.
  118. *
  119. * @since 5.5.0
  120. *
  121. * @param WP_REST_Request $request Full details about the request.
  122. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  123. */
  124. public function get_items( $request ) {
  125. require_once ABSPATH . 'wp-admin/includes/plugin.php';
  126. $plugins = array();
  127. foreach ( get_plugins() as $file => $data ) {
  128. if ( is_wp_error( $this->check_read_permission( $file ) ) ) {
  129. continue;
  130. }
  131. $data['_file'] = $file;
  132. if ( ! $this->does_plugin_match_request( $request, $data ) ) {
  133. continue;
  134. }
  135. $plugins[] = $this->prepare_response_for_collection( $this->prepare_item_for_response( $data, $request ) );
  136. }
  137. return new WP_REST_Response( $plugins );
  138. }
  139. /**
  140. * Checks if a given request has access to get a specific plugin.
  141. *
  142. * @since 5.5.0
  143. *
  144. * @param WP_REST_Request $request Full details about the request.
  145. * @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise.
  146. */
  147. public function get_item_permissions_check( $request ) {
  148. if ( ! current_user_can( 'activate_plugins' ) ) {
  149. return new WP_Error(
  150. 'rest_cannot_view_plugin',
  151. __( 'Sorry, you are not allowed to manage plugins for this site.' ),
  152. array( 'status' => rest_authorization_required_code() )
  153. );
  154. }
  155. $can_read = $this->check_read_permission( $request['plugin'] );
  156. if ( is_wp_error( $can_read ) ) {
  157. return $can_read;
  158. }
  159. return true;
  160. }
  161. /**
  162. * Retrieves one plugin from the site.
  163. *
  164. * @since 5.5.0
  165. *
  166. * @param WP_REST_Request $request Full details about the request.
  167. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  168. */
  169. public function get_item( $request ) {
  170. require_once ABSPATH . 'wp-admin/includes/plugin.php';
  171. $data = $this->get_plugin_data( $request['plugin'] );
  172. if ( is_wp_error( $data ) ) {
  173. return $data;
  174. }
  175. return $this->prepare_item_for_response( $data, $request );
  176. }
  177. /**
  178. * Checks if the given plugin can be viewed by the current user.
  179. *
  180. * On multisite, this hides non-active network only plugins if the user does not have permission
  181. * to manage network plugins.
  182. *
  183. * @since 5.5.0
  184. *
  185. * @param string $plugin The plugin file to check.
  186. * @return true|WP_Error True if can read, a WP_Error instance otherwise.
  187. */
  188. protected function check_read_permission( $plugin ) {
  189. require_once ABSPATH . 'wp-admin/includes/plugin.php';
  190. if ( ! $this->is_plugin_installed( $plugin ) ) {
  191. return new WP_Error( 'rest_plugin_not_found', __( 'Plugin not found.' ), array( 'status' => 404 ) );
  192. }
  193. if ( ! is_multisite() ) {
  194. return true;
  195. }
  196. if ( ! is_network_only_plugin( $plugin ) || is_plugin_active( $plugin ) || current_user_can( 'manage_network_plugins' ) ) {
  197. return true;
  198. }
  199. return new WP_Error(
  200. 'rest_cannot_view_plugin',
  201. __( 'Sorry, you are not allowed to manage this plugin.' ),
  202. array( 'status' => rest_authorization_required_code() )
  203. );
  204. }
  205. /**
  206. * Checks if a given request has access to upload plugins.
  207. *
  208. * @since 5.5.0
  209. *
  210. * @param WP_REST_Request $request Full details about the request.
  211. * @return true|WP_Error True if the request has access to create items, WP_Error object otherwise.
  212. */
  213. public function create_item_permissions_check( $request ) {
  214. if ( ! current_user_can( 'install_plugins' ) ) {
  215. return new WP_Error(
  216. 'rest_cannot_install_plugin',
  217. __( 'Sorry, you are not allowed to install plugins on this site.' ),
  218. array( 'status' => rest_authorization_required_code() )
  219. );
  220. }
  221. if ( 'inactive' !== $request['status'] && ! current_user_can( 'activate_plugins' ) ) {
  222. return new WP_Error(
  223. 'rest_cannot_activate_plugin',
  224. __( 'Sorry, you are not allowed to activate plugins.' ),
  225. array(
  226. 'status' => rest_authorization_required_code(),
  227. )
  228. );
  229. }
  230. return true;
  231. }
  232. /**
  233. * Uploads a plugin and optionally activates it.
  234. *
  235. * @since 5.5.0
  236. *
  237. * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
  238. *
  239. * @param WP_REST_Request $request Full details about the request.
  240. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  241. */
  242. public function create_item( $request ) {
  243. global $wp_filesystem;
  244. require_once ABSPATH . 'wp-admin/includes/file.php';
  245. require_once ABSPATH . 'wp-admin/includes/plugin.php';
  246. require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
  247. require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
  248. $slug = $request['slug'];
  249. // Verify filesystem is accessible first.
  250. $filesystem_available = $this->is_filesystem_available();
  251. if ( is_wp_error( $filesystem_available ) ) {
  252. return $filesystem_available;
  253. }
  254. $api = plugins_api(
  255. 'plugin_information',
  256. array(
  257. 'slug' => $slug,
  258. 'fields' => array(
  259. 'sections' => false,
  260. 'language_packs' => true,
  261. ),
  262. )
  263. );
  264. if ( is_wp_error( $api ) ) {
  265. if ( false !== strpos( $api->get_error_message(), 'Plugin not found.' ) ) {
  266. $api->add_data( array( 'status' => 404 ) );
  267. } else {
  268. $api->add_data( array( 'status' => 500 ) );
  269. }
  270. return $api;
  271. }
  272. $skin = new WP_Ajax_Upgrader_Skin();
  273. $upgrader = new Plugin_Upgrader( $skin );
  274. $result = $upgrader->install( $api->download_link );
  275. if ( is_wp_error( $result ) ) {
  276. $result->add_data( array( 'status' => 500 ) );
  277. return $result;
  278. }
  279. // This should be the same as $result above.
  280. if ( is_wp_error( $skin->result ) ) {
  281. $skin->result->add_data( array( 'status' => 500 ) );
  282. return $skin->result;
  283. }
  284. if ( $skin->get_errors()->has_errors() ) {
  285. $error = $skin->get_errors();
  286. $error->add_data( array( 'status' => 500 ) );
  287. return $error;
  288. }
  289. if ( is_null( $result ) ) {
  290. // Pass through the error from WP_Filesystem if one was raised.
  291. if ( $wp_filesystem instanceof WP_Filesystem_Base
  292. && is_wp_error( $wp_filesystem->errors ) && $wp_filesystem->errors->has_errors()
  293. ) {
  294. return new WP_Error(
  295. 'unable_to_connect_to_filesystem',
  296. $wp_filesystem->errors->get_error_message(),
  297. array( 'status' => 500 )
  298. );
  299. }
  300. return new WP_Error(
  301. 'unable_to_connect_to_filesystem',
  302. __( 'Unable to connect to the filesystem. Please confirm your credentials.' ),
  303. array( 'status' => 500 )
  304. );
  305. }
  306. $file = $upgrader->plugin_info();
  307. if ( ! $file ) {
  308. return new WP_Error(
  309. 'unable_to_determine_installed_plugin',
  310. __( 'Unable to determine what plugin was installed.' ),
  311. array( 'status' => 500 )
  312. );
  313. }
  314. if ( 'inactive' !== $request['status'] ) {
  315. $can_change_status = $this->plugin_status_permission_check( $file, $request['status'], 'inactive' );
  316. if ( is_wp_error( $can_change_status ) ) {
  317. return $can_change_status;
  318. }
  319. $changed_status = $this->handle_plugin_status( $file, $request['status'], 'inactive' );
  320. if ( is_wp_error( $changed_status ) ) {
  321. return $changed_status;
  322. }
  323. }
  324. // Install translations.
  325. $installed_locales = array_values( get_available_languages() );
  326. /** This filter is documented in wp-includes/update.php */
  327. $installed_locales = apply_filters( 'plugins_update_check_locales', $installed_locales );
  328. $language_packs = array_map(
  329. static function( $item ) {
  330. return (object) $item;
  331. },
  332. $api->language_packs
  333. );
  334. $language_packs = array_filter(
  335. $language_packs,
  336. static function( $pack ) use ( $installed_locales ) {
  337. return in_array( $pack->language, $installed_locales, true );
  338. }
  339. );
  340. if ( $language_packs ) {
  341. $lp_upgrader = new Language_Pack_Upgrader( $skin );
  342. // Install all applicable language packs for the plugin.
  343. $lp_upgrader->bulk_upgrade( $language_packs );
  344. }
  345. $path = WP_PLUGIN_DIR . '/' . $file;
  346. $data = get_plugin_data( $path, false, false );
  347. $data['_file'] = $file;
  348. $response = $this->prepare_item_for_response( $data, $request );
  349. $response->set_status( 201 );
  350. $response->header( 'Location', rest_url( sprintf( '%s/%s/%s', $this->namespace, $this->rest_base, substr( $file, 0, - 4 ) ) ) );
  351. return $response;
  352. }
  353. /**
  354. * Checks if a given request has access to update a specific plugin.
  355. *
  356. * @since 5.5.0
  357. *
  358. * @param WP_REST_Request $request Full details about the request.
  359. * @return true|WP_Error True if the request has access to update the item, WP_Error object otherwise.
  360. */
  361. public function update_item_permissions_check( $request ) {
  362. require_once ABSPATH . 'wp-admin/includes/plugin.php';
  363. if ( ! current_user_can( 'activate_plugins' ) ) {
  364. return new WP_Error(
  365. 'rest_cannot_manage_plugins',
  366. __( 'Sorry, you are not allowed to manage plugins for this site.' ),
  367. array( 'status' => rest_authorization_required_code() )
  368. );
  369. }
  370. $can_read = $this->check_read_permission( $request['plugin'] );
  371. if ( is_wp_error( $can_read ) ) {
  372. return $can_read;
  373. }
  374. $status = $this->get_plugin_status( $request['plugin'] );
  375. if ( $request['status'] && $status !== $request['status'] ) {
  376. $can_change_status = $this->plugin_status_permission_check( $request['plugin'], $request['status'], $status );
  377. if ( is_wp_error( $can_change_status ) ) {
  378. return $can_change_status;
  379. }
  380. }
  381. return true;
  382. }
  383. /**
  384. * Updates one plugin.
  385. *
  386. * @since 5.5.0
  387. *
  388. * @param WP_REST_Request $request Full details about the request.
  389. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  390. */
  391. public function update_item( $request ) {
  392. require_once ABSPATH . 'wp-admin/includes/plugin.php';
  393. $data = $this->get_plugin_data( $request['plugin'] );
  394. if ( is_wp_error( $data ) ) {
  395. return $data;
  396. }
  397. $status = $this->get_plugin_status( $request['plugin'] );
  398. if ( $request['status'] && $status !== $request['status'] ) {
  399. $handled = $this->handle_plugin_status( $request['plugin'], $request['status'], $status );
  400. if ( is_wp_error( $handled ) ) {
  401. return $handled;
  402. }
  403. }
  404. $this->update_additional_fields_for_object( $data, $request );
  405. $request['context'] = 'edit';
  406. return $this->prepare_item_for_response( $data, $request );
  407. }
  408. /**
  409. * Checks if a given request has access to delete a specific plugin.
  410. *
  411. * @since 5.5.0
  412. *
  413. * @param WP_REST_Request $request Full details about the request.
  414. * @return true|WP_Error True if the request has access to delete the item, WP_Error object otherwise.
  415. */
  416. public function delete_item_permissions_check( $request ) {
  417. if ( ! current_user_can( 'activate_plugins' ) ) {
  418. return new WP_Error(
  419. 'rest_cannot_manage_plugins',
  420. __( 'Sorry, you are not allowed to manage plugins for this site.' ),
  421. array( 'status' => rest_authorization_required_code() )
  422. );
  423. }
  424. if ( ! current_user_can( 'delete_plugins' ) ) {
  425. return new WP_Error(
  426. 'rest_cannot_manage_plugins',
  427. __( 'Sorry, you are not allowed to delete plugins for this site.' ),
  428. array( 'status' => rest_authorization_required_code() )
  429. );
  430. }
  431. $can_read = $this->check_read_permission( $request['plugin'] );
  432. if ( is_wp_error( $can_read ) ) {
  433. return $can_read;
  434. }
  435. return true;
  436. }
  437. /**
  438. * Deletes one plugin from the site.
  439. *
  440. * @since 5.5.0
  441. *
  442. * @param WP_REST_Request $request Full details about the request.
  443. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  444. */
  445. public function delete_item( $request ) {
  446. require_once ABSPATH . 'wp-admin/includes/file.php';
  447. require_once ABSPATH . 'wp-admin/includes/plugin.php';
  448. $data = $this->get_plugin_data( $request['plugin'] );
  449. if ( is_wp_error( $data ) ) {
  450. return $data;
  451. }
  452. if ( is_plugin_active( $request['plugin'] ) ) {
  453. return new WP_Error(
  454. 'rest_cannot_delete_active_plugin',
  455. __( 'Cannot delete an active plugin. Please deactivate it first.' ),
  456. array( 'status' => 400 )
  457. );
  458. }
  459. $filesystem_available = $this->is_filesystem_available();
  460. if ( is_wp_error( $filesystem_available ) ) {
  461. return $filesystem_available;
  462. }
  463. $prepared = $this->prepare_item_for_response( $data, $request );
  464. $deleted = delete_plugins( array( $request['plugin'] ) );
  465. if ( is_wp_error( $deleted ) ) {
  466. $deleted->add_data( array( 'status' => 500 ) );
  467. return $deleted;
  468. }
  469. return new WP_REST_Response(
  470. array(
  471. 'deleted' => true,
  472. 'previous' => $prepared->get_data(),
  473. )
  474. );
  475. }
  476. /**
  477. * Prepares the plugin for the REST response.
  478. *
  479. * @since 5.5.0
  480. *
  481. * @param array $item Unmarked up and untranslated plugin data from {@see get_plugin_data()}.
  482. * @param WP_REST_Request $request Request object.
  483. * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
  484. */
  485. public function prepare_item_for_response( $item, $request ) {
  486. $fields = $this->get_fields_for_response( $request );
  487. $item = _get_plugin_data_markup_translate( $item['_file'], $item, false );
  488. $marked = _get_plugin_data_markup_translate( $item['_file'], $item, true );
  489. $data = array(
  490. 'plugin' => substr( $item['_file'], 0, - 4 ),
  491. 'status' => $this->get_plugin_status( $item['_file'] ),
  492. 'name' => $item['Name'],
  493. 'plugin_uri' => $item['PluginURI'],
  494. 'author' => $item['Author'],
  495. 'author_uri' => $item['AuthorURI'],
  496. 'description' => array(
  497. 'raw' => $item['Description'],
  498. 'rendered' => $marked['Description'],
  499. ),
  500. 'version' => $item['Version'],
  501. 'network_only' => $item['Network'],
  502. 'requires_wp' => $item['RequiresWP'],
  503. 'requires_php' => $item['RequiresPHP'],
  504. 'textdomain' => $item['TextDomain'],
  505. );
  506. $data = $this->add_additional_fields_to_object( $data, $request );
  507. $response = new WP_REST_Response( $data );
  508. if ( rest_is_field_included( '_links', $fields ) || rest_is_field_included( '_embedded', $fields ) ) {
  509. $response->add_links( $this->prepare_links( $item ) );
  510. }
  511. /**
  512. * Filters plugin data for a REST API response.
  513. *
  514. * @since 5.5.0
  515. *
  516. * @param WP_REST_Response $response The response object.
  517. * @param array $item The plugin item from {@see get_plugin_data()}.
  518. * @param WP_REST_Request $request The request object.
  519. */
  520. return apply_filters( 'rest_prepare_plugin', $response, $item, $request );
  521. }
  522. /**
  523. * Prepares links for the request.
  524. *
  525. * @since 5.5.0
  526. *
  527. * @param array $item The plugin item.
  528. * @return array[]
  529. */
  530. protected function prepare_links( $item ) {
  531. return array(
  532. 'self' => array(
  533. 'href' => rest_url(
  534. sprintf(
  535. '%s/%s/%s',
  536. $this->namespace,
  537. $this->rest_base,
  538. substr( $item['_file'], 0, - 4 )
  539. )
  540. ),
  541. ),
  542. );
  543. }
  544. /**
  545. * Gets the plugin header data for a plugin.
  546. *
  547. * @since 5.5.0
  548. *
  549. * @param string $plugin The plugin file to get data for.
  550. * @return array|WP_Error The plugin data, or a WP_Error if the plugin is not installed.
  551. */
  552. protected function get_plugin_data( $plugin ) {
  553. $plugins = get_plugins();
  554. if ( ! isset( $plugins[ $plugin ] ) ) {
  555. return new WP_Error( 'rest_plugin_not_found', __( 'Plugin not found.' ), array( 'status' => 404 ) );
  556. }
  557. $data = $plugins[ $plugin ];
  558. $data['_file'] = $plugin;
  559. return $data;
  560. }
  561. /**
  562. * Get's the activation status for a plugin.
  563. *
  564. * @since 5.5.0
  565. *
  566. * @param string $plugin The plugin file to check.
  567. * @return string Either 'network-active', 'active' or 'inactive'.
  568. */
  569. protected function get_plugin_status( $plugin ) {
  570. if ( is_plugin_active_for_network( $plugin ) ) {
  571. return 'network-active';
  572. }
  573. if ( is_plugin_active( $plugin ) ) {
  574. return 'active';
  575. }
  576. return 'inactive';
  577. }
  578. /**
  579. * Handle updating a plugin's status.
  580. *
  581. * @since 5.5.0
  582. *
  583. * @param string $plugin The plugin file to update.
  584. * @param string $new_status The plugin's new status.
  585. * @param string $current_status The plugin's current status.
  586. * @return true|WP_Error
  587. */
  588. protected function plugin_status_permission_check( $plugin, $new_status, $current_status ) {
  589. if ( is_multisite() && ( 'network-active' === $current_status || 'network-active' === $new_status ) && ! current_user_can( 'manage_network_plugins' ) ) {
  590. return new WP_Error(
  591. 'rest_cannot_manage_network_plugins',
  592. __( 'Sorry, you are not allowed to manage network plugins.' ),
  593. array( 'status' => rest_authorization_required_code() )
  594. );
  595. }
  596. if ( ( 'active' === $new_status || 'network-active' === $new_status ) && ! current_user_can( 'activate_plugin', $plugin ) ) {
  597. return new WP_Error(
  598. 'rest_cannot_activate_plugin',
  599. __( 'Sorry, you are not allowed to activate this plugin.' ),
  600. array( 'status' => rest_authorization_required_code() )
  601. );
  602. }
  603. if ( 'inactive' === $new_status && ! current_user_can( 'deactivate_plugin', $plugin ) ) {
  604. return new WP_Error(
  605. 'rest_cannot_deactivate_plugin',
  606. __( 'Sorry, you are not allowed to deactivate this plugin.' ),
  607. array( 'status' => rest_authorization_required_code() )
  608. );
  609. }
  610. return true;
  611. }
  612. /**
  613. * Handle updating a plugin's status.
  614. *
  615. * @since 5.5.0
  616. *
  617. * @param string $plugin The plugin file to update.
  618. * @param string $new_status The plugin's new status.
  619. * @param string $current_status The plugin's current status.
  620. * @return true|WP_Error
  621. */
  622. protected function handle_plugin_status( $plugin, $new_status, $current_status ) {
  623. if ( 'inactive' === $new_status ) {
  624. deactivate_plugins( $plugin, false, 'network-active' === $current_status );
  625. return true;
  626. }
  627. if ( 'active' === $new_status && 'network-active' === $current_status ) {
  628. return true;
  629. }
  630. $network_activate = 'network-active' === $new_status;
  631. if ( is_multisite() && ! $network_activate && is_network_only_plugin( $plugin ) ) {
  632. return new WP_Error(
  633. 'rest_network_only_plugin',
  634. __( 'Network only plugin must be network activated.' ),
  635. array( 'status' => 400 )
  636. );
  637. }
  638. $activated = activate_plugin( $plugin, '', $network_activate );
  639. if ( is_wp_error( $activated ) ) {
  640. $activated->add_data( array( 'status' => 500 ) );
  641. return $activated;
  642. }
  643. return true;
  644. }
  645. /**
  646. * Checks that the "plugin" parameter is a valid path.
  647. *
  648. * @since 5.5.0
  649. *
  650. * @param string $file The plugin file parameter.
  651. * @return bool
  652. */
  653. public function validate_plugin_param( $file ) {
  654. if ( ! is_string( $file ) || ! preg_match( '/' . self::PATTERN . '/u', $file ) ) {
  655. return false;
  656. }
  657. $validated = validate_file( plugin_basename( $file ) );
  658. return 0 === $validated;
  659. }
  660. /**
  661. * Sanitizes the "plugin" parameter to be a proper plugin file with ".php" appended.
  662. *
  663. * @since 5.5.0
  664. *
  665. * @param string $file The plugin file parameter.
  666. * @return string
  667. */
  668. public function sanitize_plugin_param( $file ) {
  669. return plugin_basename( sanitize_text_field( $file . '.php' ) );
  670. }
  671. /**
  672. * Checks if the plugin matches the requested parameters.
  673. *
  674. * @since 5.5.0
  675. *
  676. * @param WP_REST_Request $request The request to require the plugin matches against.
  677. * @param array $item The plugin item.
  678. * @return bool
  679. */
  680. protected function does_plugin_match_request( $request, $item ) {
  681. $search = $request['search'];
  682. if ( $search ) {
  683. $matched_search = false;
  684. foreach ( $item as $field ) {
  685. if ( is_string( $field ) && false !== strpos( strip_tags( $field ), $search ) ) {
  686. $matched_search = true;
  687. break;
  688. }
  689. }
  690. if ( ! $matched_search ) {
  691. return false;
  692. }
  693. }
  694. $status = $request['status'];
  695. if ( $status && ! in_array( $this->get_plugin_status( $item['_file'] ), $status, true ) ) {
  696. return false;
  697. }
  698. return true;
  699. }
  700. /**
  701. * Checks if the plugin is installed.
  702. *
  703. * @since 5.5.0
  704. *
  705. * @param string $plugin The plugin file.
  706. * @return bool
  707. */
  708. protected function is_plugin_installed( $plugin ) {
  709. return file_exists( WP_PLUGIN_DIR . '/' . $plugin );
  710. }
  711. /**
  712. * Determine if the endpoints are available.
  713. *
  714. * Only the 'Direct' filesystem transport, and SSH/FTP when credentials are stored are supported at present.
  715. *
  716. * @since 5.5.0
  717. *
  718. * @return true|WP_Error True if filesystem is available, WP_Error otherwise.
  719. */
  720. protected function is_filesystem_available() {
  721. $filesystem_method = get_filesystem_method();
  722. if ( 'direct' === $filesystem_method ) {
  723. return true;
  724. }
  725. ob_start();
  726. $filesystem_credentials_are_stored = request_filesystem_credentials( self_admin_url() );
  727. ob_end_clean();
  728. if ( $filesystem_credentials_are_stored ) {
  729. return true;
  730. }
  731. return new WP_Error( 'fs_unavailable', __( 'The filesystem is currently unavailable for managing plugins.' ), array( 'status' => 500 ) );
  732. }
  733. /**
  734. * Retrieves the plugin's schema, conforming to JSON Schema.
  735. *
  736. * @since 5.5.0
  737. *
  738. * @return array Item schema data.
  739. */
  740. public function get_item_schema() {
  741. if ( $this->schema ) {
  742. return $this->add_additional_fields_schema( $this->schema );
  743. }
  744. $this->schema = array(
  745. '$schema' => 'http://json-schema.org/draft-04/schema#',
  746. 'title' => 'plugin',
  747. 'type' => 'object',
  748. 'properties' => array(
  749. 'plugin' => array(
  750. 'description' => __( 'The plugin file.' ),
  751. 'type' => 'string',
  752. 'pattern' => self::PATTERN,
  753. 'readonly' => true,
  754. 'context' => array( 'view', 'edit', 'embed' ),
  755. ),
  756. 'status' => array(
  757. 'description' => __( 'The plugin activation status.' ),
  758. 'type' => 'string',
  759. 'enum' => is_multisite() ? array( 'inactive', 'active', 'network-active' ) : array( 'inactive', 'active' ),
  760. 'context' => array( 'view', 'edit', 'embed' ),
  761. ),
  762. 'name' => array(
  763. 'description' => __( 'The plugin name.' ),
  764. 'type' => 'string',
  765. 'readonly' => true,
  766. 'context' => array( 'view', 'edit', 'embed' ),
  767. ),
  768. 'plugin_uri' => array(
  769. 'description' => __( 'The plugin\'s website address.' ),
  770. 'type' => 'string',
  771. 'format' => 'uri',
  772. 'readonly' => true,
  773. 'context' => array( 'view', 'edit' ),
  774. ),
  775. 'author' => array(
  776. 'description' => __( 'The plugin author.' ),
  777. 'type' => 'object',
  778. 'readonly' => true,
  779. 'context' => array( 'view', 'edit' ),
  780. ),
  781. 'author_uri' => array(
  782. 'description' => __( 'Plugin author\'s website address.' ),
  783. 'type' => 'string',
  784. 'format' => 'uri',
  785. 'readonly' => true,
  786. 'context' => array( 'view', 'edit' ),
  787. ),
  788. 'description' => array(
  789. 'description' => __( 'The plugin description.' ),
  790. 'type' => 'object',
  791. 'readonly' => true,
  792. 'context' => array( 'view', 'edit' ),
  793. 'properties' => array(
  794. 'raw' => array(
  795. 'description' => __( 'The raw plugin description.' ),
  796. 'type' => 'string',
  797. ),
  798. 'rendered' => array(
  799. 'description' => __( 'The plugin description formatted for display.' ),
  800. 'type' => 'string',
  801. ),
  802. ),
  803. ),
  804. 'version' => array(
  805. 'description' => __( 'The plugin version number.' ),
  806. 'type' => 'string',
  807. 'readonly' => true,
  808. 'context' => array( 'view', 'edit' ),
  809. ),
  810. 'network_only' => array(
  811. 'description' => __( 'Whether the plugin can only be activated network-wide.' ),
  812. 'type' => 'boolean',
  813. 'readonly' => true,
  814. 'context' => array( 'view', 'edit', 'embed' ),
  815. ),
  816. 'requires_wp' => array(
  817. 'description' => __( 'Minimum required version of WordPress.' ),
  818. 'type' => 'string',
  819. 'readonly' => true,
  820. 'context' => array( 'view', 'edit', 'embed' ),
  821. ),
  822. 'requires_php' => array(
  823. 'description' => __( 'Minimum required version of PHP.' ),
  824. 'type' => 'string',
  825. 'readonly' => true,
  826. 'context' => array( 'view', 'edit', 'embed' ),
  827. ),
  828. 'textdomain' => array(
  829. 'description' => __( 'The plugin\'s text domain.' ),
  830. 'type' => 'string',
  831. 'readonly' => true,
  832. 'context' => array( 'view', 'edit' ),
  833. ),
  834. ),
  835. );
  836. return $this->add_additional_fields_schema( $this->schema );
  837. }
  838. /**
  839. * Retrieves the query params for the collections.
  840. *
  841. * @since 5.5.0
  842. *
  843. * @return array Query parameters for the collection.
  844. */
  845. public function get_collection_params() {
  846. $query_params = parent::get_collection_params();
  847. $query_params['context']['default'] = 'view';
  848. $query_params['status'] = array(
  849. 'description' => __( 'Limits results to plugins with the given status.' ),
  850. 'type' => 'array',
  851. 'items' => array(
  852. 'type' => 'string',
  853. 'enum' => is_multisite() ? array( 'inactive', 'active', 'network-active' ) : array( 'inactive', 'active' ),
  854. ),
  855. );
  856. unset( $query_params['page'], $query_params['per_page'] );
  857. return $query_params;
  858. }
  859. }