Skip to content

Commit 19d13a2

Browse files
tfrommentfrommen
committed
Merge remote-tracking branch 'upstream/master' into validate-grant-types
2 parents d29512c + ac30389 commit 19d13a2

File tree

8 files changed

+287
-124
lines changed

8 files changed

+287
-124
lines changed

‎admin.php

Lines changed: 0 additions & 100 deletions
This file was deleted.

‎inc/admin/class-admin.php

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,10 @@ public static function load() {
6969
self::handle_regenerate();
7070
break;
7171

72+
case 'approve':
73+
self::handle_approve();
74+
break;
75+
7276
default:
7377
global $wp_list_table;
7478

@@ -86,6 +90,7 @@ public static function dispatch() {
8690
case 'add':
8791
case 'edit':
8892
case 'delete':
93+
case 'approve':
8994
break;
9095

9196
default:
@@ -116,6 +121,8 @@ class="add-new-h2"><?php echo esc_html_x( 'Add New', 'application', 'rest_oauth2
116121
<?php
117122
if ( ! empty( $_GET['deleted'] ) ) {
118123
echo '<div id="message" class="updated"><p>' . esc_html__( 'Deleted application.', 'rest_oauth2' ) . '</p></div>';
124+
} elseif ( ! empty( $_GET['approved'] ) ) {
125+
echo '<div id="message" class="updated"><p>' . esc_html__( 'Approved application.', 'rest_oauth2' ) . '</p></div>';
119126
}
120127
?>
121128

@@ -480,6 +487,39 @@ public static function handle_delete() {
480487
exit;
481488
}
482489

490+
/**
491+
* Approve the client.
492+
*/
493+
public static function handle_approve() {
494+
if ( empty( $_GET['id'] ) ) {
495+
return;
496+
}
497+
498+
$id = absint( $_GET['id'] );
499+
check_admin_referer( 'rest-oauth2-approve:' . $id );
500+
501+
if ( ! current_user_can( 'publish_post', $id ) ) {
502+
wp_die(
503+
'<h1>' . __( 'Cheatin&#8217; uh?', 'rest_oauth2' ) . '</h1>' .
504+
'<p>' . __( 'You are not allowed to approve this application.', 'rest_oauth2' ) . '</p>',
505+
403
506+
);
507+
}
508+
509+
$client = Client::get_by_post_id( $id );
510+
if ( is_wp_error( $client ) ) {
511+
wp_die( $client );
512+
}
513+
514+
$did_approve = $client->approve();
515+
if ( is_wp_error( $did_approve ) ) {
516+
wp_die( $did_approve );
517+
}
518+
519+
wp_safe_redirect( self::get_urL( 'approved=1' ) );
520+
exit;
521+
}
522+
483523
/**
484524
* Regenerate the client secret.
485525
*/

‎inc/admin/class-listtable.php

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,37 @@ protected function column_name( $item ) {
102102
'edit' => sprintf( '<a href="%s">%s</a>', esc_url( $edit_link ), esc_html__( 'Edit', 'rest_oauth2' ) ),
103103
'delete' => sprintf( '<a href="%s">%s</a>', esc_url( $delete_link ), esc_html__( 'Delete', 'rest_oauth2' ) ),
104104
];
105+
106+
$post_type_object = get_post_type_object( $item->post_type );
107+
if ( current_user_can( $post_type_object->cap->publish_posts ) && $item->post_status !== 'publish' ) {
108+
$publish_link = add_query_arg(
109+
[
110+
'page' => 'rest-oauth2-apps',
111+
'action' => 'approve',
112+
'id' => $item->ID,
113+
],
114+
admin_url( 'users.php' )
115+
);
116+
$publish_link = wp_nonce_url( $publish_link, 'rest-oauth2-approve:' . $item->ID );
117+
$actions['app-approve'] = sprintf(
118+
'<a href="%s">%s</a>',
119+
esc_url( $publish_link ),
120+
esc_html__( 'Approve', 'rest_oauth2' )
121+
);
122+
}
123+
105124
$action_html = $this->row_actions( $actions );
106125

126+
// Get suffixes for draft, etc
127+
ob_start();
128+
_post_states( $item );
129+
$title = sprintf(
130+
'<strong><a href="%s">%s</a>%s</strong>',
131+
$edit_link,
132+
$title,
133+
ob_get_clean()
134+
);
135+
107136
return $title . ' ' . $action_html;
108137
}
109138

‎inc/admin/profile/namespace.php

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
<?php
2+
/**
3+
* Administration UI and utilities
4+
*/
5+
6+
namespace WP\OAuth2\Admin\Profile;
7+
8+
use WP\OAuth2\Tokens\Access_Token;
9+
use WP_User;
10+
11+
/**
12+
* Bootstrap actions for the profile screen.
13+
*/
14+
function bootstrap() {
15+
add_action( 'personal_options', __NAMESPACE__ . '\\render_profile_section', 50 );
16+
add_action( 'all_admin_notices', __NAMESPACE__ . '\\output_profile_messages' );
17+
add_action( 'personal_options_update', __NAMESPACE__ . '\\handle_revocation', 10, 1 );
18+
add_action( 'edit_user_profile_update', __NAMESPACE__ . '\\handle_revocation', 10, 1 );
19+
}
20+
21+
/**
22+
* Render current tokens for a user.
23+
*
24+
* @param WP_User $user User whose profile is being rendered.
25+
*/
26+
function render_profile_section( WP_User $user ) {
27+
$tokens = Access_Token::get_for_user( $user );
28+
?>
29+
<table class="form-table">
30+
<tbody>
31+
<tr>
32+
<th scope="row"><?php _e( 'Authorized Applications', 'rest_oauth1' ) ?></th>
33+
<td>
34+
<?php if ( ! empty( $tokens ) ): ?>
35+
<table class="widefat">
36+
<thead>
37+
<tr>
38+
<th style="padding-left:10px;"><?php esc_html_e( 'Application Name', 'rest_oauth1' ); ?></th>
39+
<th></th>
40+
</tr>
41+
</thead>
42+
<tbody>
43+
<?php foreach ( $tokens as $token ): ?>
44+
<?php
45+
/** @var Access_Token $token */
46+
$client = $token->get_client();
47+
?>
48+
<tr>
49+
<td><?php echo $client->get_name() ?></td>
50+
<td><button class="button" name="oauth2_revoke" value="<?php echo esc_attr( $token->get_key() ) ?>"><?php esc_html_e( 'Revoke', 'rest_oauth1' ) ?></button>
51+
</tr>
52+
53+
<?php endforeach ?>
54+
</tbody>
55+
</table>
56+
<?php else: ?>
57+
<p class="description"><?php esc_html_e( 'No applications authorized.', 'rest_oauth1' ) ?></p>
58+
<?php endif ?>
59+
</td>
60+
</tr>
61+
</tbody>
62+
</table>
63+
<?php
64+
}
65+
66+
/**
67+
* Output messages based on previous actions.
68+
*/
69+
function output_profile_messages() {
70+
global $pagenow;
71+
if ( $pagenow !== 'profile.php' && $pagenow !== 'user-edit.php' ) {
72+
return;
73+
}
74+
75+
if ( ! empty( $_GET['oauth2_revoked'] ) ) {
76+
echo '<div id="message" class="updated"><p>' . __( 'Token revoked.', 'oauth2' ) . '</p></div>';
77+
}
78+
if ( ! empty( $_GET['oauth2_revocation_failed'] ) ) {
79+
echo '<div id="message" class="updated"><p>' . __( 'Unable to revoke token.', 'oauth2' ) . '</p></div>';
80+
}
81+
}
82+
83+
/**
84+
* Handle a revocation.
85+
*
86+
* @param int $user_id
87+
*/
88+
function handle_revocation( $user_id ) {
89+
if ( empty( $_POST['oauth2_revoke'] ) ) {
90+
return;
91+
}
92+
93+
$key = wp_unslash( $_POST['oauth2_revoke'] );
94+
$token = Access_Token::get_by_id( $key );
95+
if ( empty( $token ) ) {
96+
var_dump( $key, $token );
97+
wp_safe_redirect( add_query_arg( 'oauth2_revocation_failed', true, get_edit_user_link( $user_id ) ) );
98+
exit;
99+
}
100+
101+
// Check it's for the right user.
102+
if ( $token->get_user_id() !== $user_id ) {
103+
wp_die();
104+
}
105+
106+
$result = $token->revoke();
107+
if ( is_wp_error( $result ) ) {
108+
wp_safe_redirect( add_query_arg( 'oauth2_revocation_failed', true, get_edit_user_link( $user_id ) ) );
109+
exit;
110+
}
111+
112+
// Success, redirect and tell the user.
113+
wp_safe_redirect( add_query_arg( 'oauth2_revoked', $key, get_edit_user_link( $user_id ) ) );
114+
exit;
115+
}

‎inc/class-client.php

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,20 @@ public function delete() {
423423
return (bool) wp_delete_post( $this->get_post_id(), true );
424424
}
425425

426+
/**
427+
* Approve a client.
428+
*
429+
* @return bool|WP_Error True if client was updated, error otherwise.
430+
*/
431+
public function approve() {
432+
$data = array(
433+
'ID' => $this->get_post_id(),
434+
'post_status' => 'publish',
435+
);
436+
$result = wp_update_post( wp_slash( $data ), true );
437+
return is_wp_error( $result ) ? $result : true;
438+
}
439+
426440
/**
427441
* Register the underlying post type.
428442
*/
@@ -431,8 +445,13 @@ public static function register_type() {
431445
'public' => false,
432446
'hierarchical' => true,
433447
'capability_type' => array(
434-
'client',
435-
'clients',
448+
'oauth2_client',
449+
'oauth2_clients',
450+
),
451+
'capabilities' => array(
452+
'edit_posts' => 'edit_users',
453+
'edit_others_posts' => 'edit_users',
454+
'publish_posts' => 'edit_users',
436455
),
437456
'supports' => array(
438457
'title',

0 commit comments

Comments
 (0)