class-wp-oembed-controller.php 6.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246
  1. <?php
  2. /**
  3. * WP_oEmbed_Controller class, used to provide an oEmbed endpoint.
  4. *
  5. * @package WordPress
  6. * @subpackage Embeds
  7. * @since 4.4.0
  8. */
  9. /**
  10. * oEmbed API endpoint controller.
  11. *
  12. * Registers the REST API route and delivers the response data.
  13. * The output format (XML or JSON) is handled by the REST API.
  14. *
  15. * @since 4.4.0
  16. */
  17. #[AllowDynamicProperties]
  18. final class WP_oEmbed_Controller {
  19. /**
  20. * Register the oEmbed REST API route.
  21. *
  22. * @since 4.4.0
  23. */
  24. public function register_routes() {
  25. /**
  26. * Filters the maxwidth oEmbed parameter.
  27. *
  28. * @since 4.4.0
  29. *
  30. * @param int $maxwidth Maximum allowed width. Default 600.
  31. */
  32. $maxwidth = apply_filters( 'oembed_default_width', 600 );
  33. register_rest_route(
  34. 'oembed/1.0',
  35. '/embed',
  36. array(
  37. array(
  38. 'methods' => WP_REST_Server::READABLE,
  39. 'callback' => array( $this, 'get_item' ),
  40. 'permission_callback' => '__return_true',
  41. 'args' => array(
  42. 'url' => array(
  43. 'description' => __( 'The URL of the resource for which to fetch oEmbed data.' ),
  44. 'required' => true,
  45. 'type' => 'string',
  46. 'format' => 'uri',
  47. ),
  48. 'format' => array(
  49. 'default' => 'json',
  50. 'sanitize_callback' => 'wp_oembed_ensure_format',
  51. ),
  52. 'maxwidth' => array(
  53. 'default' => $maxwidth,
  54. 'sanitize_callback' => 'absint',
  55. ),
  56. ),
  57. ),
  58. )
  59. );
  60. register_rest_route(
  61. 'oembed/1.0',
  62. '/proxy',
  63. array(
  64. array(
  65. 'methods' => WP_REST_Server::READABLE,
  66. 'callback' => array( $this, 'get_proxy_item' ),
  67. 'permission_callback' => array( $this, 'get_proxy_item_permissions_check' ),
  68. 'args' => array(
  69. 'url' => array(
  70. 'description' => __( 'The URL of the resource for which to fetch oEmbed data.' ),
  71. 'required' => true,
  72. 'type' => 'string',
  73. 'format' => 'uri',
  74. ),
  75. 'format' => array(
  76. 'description' => __( 'The oEmbed format to use.' ),
  77. 'type' => 'string',
  78. 'default' => 'json',
  79. 'enum' => array(
  80. 'json',
  81. 'xml',
  82. ),
  83. ),
  84. 'maxwidth' => array(
  85. 'description' => __( 'The maximum width of the embed frame in pixels.' ),
  86. 'type' => 'integer',
  87. 'default' => $maxwidth,
  88. 'sanitize_callback' => 'absint',
  89. ),
  90. 'maxheight' => array(
  91. 'description' => __( 'The maximum height of the embed frame in pixels.' ),
  92. 'type' => 'integer',
  93. 'sanitize_callback' => 'absint',
  94. ),
  95. 'discover' => array(
  96. 'description' => __( 'Whether to perform an oEmbed discovery request for unsanctioned providers.' ),
  97. 'type' => 'boolean',
  98. 'default' => true,
  99. ),
  100. ),
  101. ),
  102. )
  103. );
  104. }
  105. /**
  106. * Callback for the embed API endpoint.
  107. *
  108. * Returns the JSON object for the post.
  109. *
  110. * @since 4.4.0
  111. *
  112. * @param WP_REST_Request $request Full data about the request.
  113. * @return array|WP_Error oEmbed response data or WP_Error on failure.
  114. */
  115. public function get_item( $request ) {
  116. $post_id = url_to_postid( $request['url'] );
  117. /**
  118. * Filters the determined post ID.
  119. *
  120. * @since 4.4.0
  121. *
  122. * @param int $post_id The post ID.
  123. * @param string $url The requested URL.
  124. */
  125. $post_id = apply_filters( 'oembed_request_post_id', $post_id, $request['url'] );
  126. $data = get_oembed_response_data( $post_id, $request['maxwidth'] );
  127. if ( ! $data ) {
  128. return new WP_Error( 'oembed_invalid_url', get_status_header_desc( 404 ), array( 'status' => 404 ) );
  129. }
  130. return $data;
  131. }
  132. /**
  133. * Checks if current user can make a proxy oEmbed request.
  134. *
  135. * @since 4.8.0
  136. *
  137. * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
  138. */
  139. public function get_proxy_item_permissions_check() {
  140. if ( ! current_user_can( 'edit_posts' ) ) {
  141. return new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to make proxied oEmbed requests.' ), array( 'status' => rest_authorization_required_code() ) );
  142. }
  143. return true;
  144. }
  145. /**
  146. * Callback for the proxy API endpoint.
  147. *
  148. * Returns the JSON object for the proxied item.
  149. *
  150. * @since 4.8.0
  151. *
  152. * @see WP_oEmbed::get_html()
  153. * @global WP_Embed $wp_embed
  154. *
  155. * @param WP_REST_Request $request Full data about the request.
  156. * @return object|WP_Error oEmbed response data or WP_Error on failure.
  157. */
  158. public function get_proxy_item( $request ) {
  159. global $wp_embed;
  160. $args = $request->get_params();
  161. // Serve oEmbed data from cache if set.
  162. unset( $args['_wpnonce'] );
  163. $cache_key = 'oembed_' . md5( serialize( $args ) );
  164. $data = get_transient( $cache_key );
  165. if ( ! empty( $data ) ) {
  166. return $data;
  167. }
  168. $url = $request['url'];
  169. unset( $args['url'] );
  170. // Copy maxwidth/maxheight to width/height since WP_oEmbed::fetch() uses these arg names.
  171. if ( isset( $args['maxwidth'] ) ) {
  172. $args['width'] = $args['maxwidth'];
  173. }
  174. if ( isset( $args['maxheight'] ) ) {
  175. $args['height'] = $args['maxheight'];
  176. }
  177. // Short-circuit process for URLs belonging to the current site.
  178. $data = get_oembed_response_data_for_url( $url, $args );
  179. if ( $data ) {
  180. return $data;
  181. }
  182. $data = _wp_oembed_get_object()->get_data( $url, $args );
  183. if ( false === $data ) {
  184. // Try using a classic embed, instead.
  185. /* @var WP_Embed $wp_embed */
  186. $html = $wp_embed->get_embed_handler_html( $args, $url );
  187. if ( $html ) {
  188. global $wp_scripts;
  189. // Check if any scripts were enqueued by the shortcode, and include them in the response.
  190. $enqueued_scripts = array();
  191. foreach ( $wp_scripts->queue as $script ) {
  192. $enqueued_scripts[] = $wp_scripts->registered[ $script ]->src;
  193. }
  194. return (object) array(
  195. 'provider_name' => __( 'Embed Handler' ),
  196. 'html' => $html,
  197. 'scripts' => $enqueued_scripts,
  198. );
  199. }
  200. return new WP_Error( 'oembed_invalid_url', get_status_header_desc( 404 ), array( 'status' => 404 ) );
  201. }
  202. /** This filter is documented in wp-includes/class-wp-oembed.php */
  203. $data->html = apply_filters( 'oembed_result', _wp_oembed_get_object()->data2html( (object) $data, $url ), $url, $args );
  204. /**
  205. * Filters the oEmbed TTL value (time to live).
  206. *
  207. * Similar to the {@see 'oembed_ttl'} filter, but for the REST API
  208. * oEmbed proxy endpoint.
  209. *
  210. * @since 4.8.0
  211. *
  212. * @param int $time Time to live (in seconds).
  213. * @param string $url The attempted embed URL.
  214. * @param array $args An array of embed request arguments.
  215. */
  216. $ttl = apply_filters( 'rest_oembed_ttl', DAY_IN_SECONDS, $url, $args );
  217. set_transient( $cache_key, $data, $ttl );
  218. return $data;
  219. }
  220. }