[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * REST API: WP_REST_Autosaves_Controller class.
   4   *
   5   * @package WordPress
   6   * @subpackage REST_API
   7   * @since 5.0.0
   8   */
   9  
  10  /**
  11   * Core class used to access autosaves via the REST API.
  12   *
  13   * @since 5.0.0
  14   *
  15   * @see WP_REST_Revisions_Controller
  16   * @see WP_REST_Controller
  17   */
  18  class WP_REST_Autosaves_Controller extends WP_REST_Revisions_Controller {
  19  
  20      /**
  21       * Parent post type.
  22       *
  23       * @since 5.0.0
  24       * @var string
  25       */
  26      private $parent_post_type;
  27  
  28      /**
  29       * Parent post controller.
  30       *
  31       * @since 5.0.0
  32       * @var WP_REST_Controller
  33       */
  34      private $parent_controller;
  35  
  36      /**
  37       * Revision controller.
  38       *
  39       * @since 5.0.0
  40       * @var WP_REST_Revisions_Controller
  41       */
  42      private $revisions_controller;
  43  
  44      /**
  45       * The base of the parent controller's route.
  46       *
  47       * @since 5.0.0
  48       * @var string
  49       */
  50      private $parent_base;
  51  
  52      /**
  53       * Constructor.
  54       *
  55       * @since 5.0.0
  56       *
  57       * @param string $parent_post_type Post type of the parent.
  58       */
  59  	public function __construct( $parent_post_type ) {
  60          $this->parent_post_type = $parent_post_type;
  61          $post_type_object       = get_post_type_object( $parent_post_type );
  62          $parent_controller      = $post_type_object->get_rest_controller();
  63  
  64          if ( ! $parent_controller ) {
  65              $parent_controller = new WP_REST_Posts_Controller( $parent_post_type );
  66          }
  67  
  68          $this->parent_controller = $parent_controller;
  69  
  70          $revisions_controller = $post_type_object->get_revisions_rest_controller();
  71          if ( ! $revisions_controller ) {
  72              $revisions_controller = new WP_REST_Revisions_Controller( $parent_post_type );
  73          }
  74          $this->revisions_controller = $revisions_controller;
  75          $this->rest_base            = 'autosaves';
  76          $this->parent_base          = ! empty( $post_type_object->rest_base ) ? $post_type_object->rest_base : $post_type_object->name;
  77          $this->namespace            = ! empty( $post_type_object->rest_namespace ) ? $post_type_object->rest_namespace : 'wp/v2';
  78      }
  79  
  80      /**
  81       * Registers the routes for autosaves.
  82       *
  83       * @since 5.0.0
  84       *
  85       * @see register_rest_route()
  86       */
  87  	public function register_routes() {
  88          register_rest_route(
  89              $this->namespace,
  90              '/' . $this->parent_base . '/(?P<id>[\d]+)/' . $this->rest_base,
  91              array(
  92                  'args'   => array(
  93                      'parent' => array(
  94                          'description' => __( 'The ID for the parent of the autosave.' ),
  95                          'type'        => 'integer',
  96                      ),
  97                  ),
  98                  array(
  99                      'methods'             => WP_REST_Server::READABLE,
 100                      'callback'            => array( $this, 'get_items' ),
 101                      'permission_callback' => array( $this, 'get_items_permissions_check' ),
 102                      'args'                => $this->get_collection_params(),
 103                  ),
 104                  array(
 105                      'methods'             => WP_REST_Server::CREATABLE,
 106                      'callback'            => array( $this, 'create_item' ),
 107                      'permission_callback' => array( $this, 'create_item_permissions_check' ),
 108                      'args'                => $this->parent_controller->get_endpoint_args_for_item_schema( WP_REST_Server::EDITABLE ),
 109                  ),
 110                  'schema' => array( $this, 'get_public_item_schema' ),
 111              )
 112          );
 113  
 114          register_rest_route(
 115              $this->namespace,
 116              '/' . $this->parent_base . '/(?P<parent>[\d]+)/' . $this->rest_base . '/(?P<id>[\d]+)',
 117              array(
 118                  'args'   => array(
 119                      'parent' => array(
 120                          'description' => __( 'The ID for the parent of the autosave.' ),
 121                          'type'        => 'integer',
 122                      ),
 123                      'id'     => array(
 124                          'description' => __( 'The ID for the autosave.' ),
 125                          'type'        => 'integer',
 126                      ),
 127                  ),
 128                  array(
 129                      'methods'             => WP_REST_Server::READABLE,
 130                      'callback'            => array( $this, 'get_item' ),
 131                      'permission_callback' => array( $this->revisions_controller, 'get_item_permissions_check' ),
 132                      'args'                => array(
 133                          'context' => $this->get_context_param( array( 'default' => 'view' ) ),
 134                      ),
 135                  ),
 136                  'schema' => array( $this, 'get_public_item_schema' ),
 137              )
 138          );
 139      }
 140  
 141      /**
 142       * Get the parent post.
 143       *
 144       * @since 5.0.0
 145       *
 146       * @param int $parent_id Supplied ID.
 147       * @return WP_Post|WP_Error Post object if ID is valid, WP_Error otherwise.
 148       */
 149  	protected function get_parent( $parent_id ) {
 150          return $this->revisions_controller->get_parent( $parent_id );
 151      }
 152  
 153      /**
 154       * Checks if a given request has access to get autosaves.
 155       *
 156       * @since 5.0.0
 157       *
 158       * @param WP_REST_Request $request Full details about the request.
 159       * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
 160       */
 161  	public function get_items_permissions_check( $request ) {
 162          $parent = $this->get_parent( $request['id'] );
 163          if ( is_wp_error( $parent ) ) {
 164              return $parent;
 165          }
 166  
 167          if ( ! current_user_can( 'edit_post', $parent->ID ) ) {
 168              return new WP_Error(
 169                  'rest_cannot_read',
 170                  __( 'Sorry, you are not allowed to view autosaves of this post.' ),
 171                  array( 'status' => rest_authorization_required_code() )
 172              );
 173          }
 174  
 175          return true;
 176      }
 177  
 178      /**
 179       * Checks if a given request has access to create an autosave revision.
 180       *
 181       * Autosave revisions inherit permissions from the parent post,
 182       * check if the current user has permission to edit the post.
 183       *
 184       * @since 5.0.0
 185       *
 186       * @param WP_REST_Request $request Full details about the request.
 187       * @return true|WP_Error True if the request has access to create the item, WP_Error object otherwise.
 188       */
 189  	public function create_item_permissions_check( $request ) {
 190          $id = $request->get_param( 'id' );
 191  
 192          if ( empty( $id ) ) {
 193              return new WP_Error(
 194                  'rest_post_invalid_id',
 195                  __( 'Invalid item ID.' ),
 196                  array( 'status' => 404 )
 197              );
 198          }
 199  
 200          return $this->parent_controller->update_item_permissions_check( $request );
 201      }
 202  
 203      /**
 204       * Creates, updates or deletes an autosave revision.
 205       *
 206       * @since 5.0.0
 207       *
 208       * @param WP_REST_Request $request Full details about the request.
 209       * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
 210       */
 211  	public function create_item( $request ) {
 212  
 213          if ( ! defined( 'WP_RUN_CORE_TESTS' ) && ! defined( 'DOING_AUTOSAVE' ) ) {
 214              define( 'DOING_AUTOSAVE', true );
 215          }
 216  
 217          $post = $this->get_parent( $request['id'] );
 218  
 219          if ( is_wp_error( $post ) ) {
 220              return $post;
 221          }
 222  
 223          $prepared_post     = $this->parent_controller->prepare_item_for_database( $request );
 224          $prepared_post->ID = $post->ID;
 225          $user_id           = get_current_user_id();
 226  
 227          // We need to check post lock to ensure the original author didn't leave their browser tab open.
 228          if ( ! function_exists( 'wp_check_post_lock' ) ) {
 229              require_once  ABSPATH . 'wp-admin/includes/post.php';
 230          }
 231  
 232          $post_lock = wp_check_post_lock( $post->ID );
 233          $is_draft  = 'draft' === $post->post_status || 'auto-draft' === $post->post_status;
 234  
 235          if ( $is_draft && (int) $post->post_author === $user_id && ! $post_lock ) {
 236              /*
 237               * Draft posts for the same author: autosaving updates the post and does not create a revision.
 238               * Convert the post object to an array and add slashes, wp_update_post() expects escaped array.
 239               */
 240              $autosave_id = wp_update_post( wp_slash( (array) $prepared_post ), true );
 241          } else {
 242              // Non-draft posts: create or update the post autosave. Pass the meta data.
 243              $autosave_id = $this->create_post_autosave( (array) $prepared_post, (array) $request->get_param( 'meta' ) );
 244          }
 245  
 246          if ( is_wp_error( $autosave_id ) ) {
 247              return $autosave_id;
 248          }
 249  
 250          $autosave = get_post( $autosave_id );
 251          $request->set_param( 'context', 'edit' );
 252  
 253          $response = $this->prepare_item_for_response( $autosave, $request );
 254          $response = rest_ensure_response( $response );
 255  
 256          return $response;
 257      }
 258  
 259      /**
 260       * Get the autosave, if the ID is valid.
 261       *
 262       * @since 5.0.0
 263       *
 264       * @param WP_REST_Request $request Full details about the request.
 265       * @return WP_Post|WP_Error Revision post object if ID is valid, WP_Error otherwise.
 266       */
 267  	public function get_item( $request ) {
 268          $parent_id = (int) $request->get_param( 'parent' );
 269  
 270          if ( $parent_id <= 0 ) {
 271              return new WP_Error(
 272                  'rest_post_invalid_id',
 273                  __( 'Invalid post parent ID.' ),
 274                  array( 'status' => 404 )
 275              );
 276          }
 277  
 278          $autosave = wp_get_post_autosave( $parent_id );
 279  
 280          if ( ! $autosave ) {
 281              return new WP_Error(
 282                  'rest_post_no_autosave',
 283                  __( 'There is no autosave revision for this post.' ),
 284                  array( 'status' => 404 )
 285              );
 286          }
 287  
 288          $response = $this->prepare_item_for_response( $autosave, $request );
 289          return $response;
 290      }
 291  
 292      /**
 293       * Gets a collection of autosaves using wp_get_post_autosave.
 294       *
 295       * Contains the user's autosave, for empty if it doesn't exist.
 296       *
 297       * @since 5.0.0
 298       *
 299       * @param WP_REST_Request $request Full details about the request.
 300       * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
 301       */
 302  	public function get_items( $request ) {
 303          $parent = $this->get_parent( $request['id'] );
 304          if ( is_wp_error( $parent ) ) {
 305              return $parent;
 306          }
 307  
 308          if ( $request->is_method( 'HEAD' ) ) {
 309              // Return early as this handler doesn't add any response headers.
 310              return new WP_REST_Response( array() );
 311          }
 312          $response  = array();
 313          $parent_id = $parent->ID;
 314          $revisions = wp_get_post_revisions( $parent_id, array( 'check_enabled' => false ) );
 315  
 316          foreach ( $revisions as $revision ) {
 317              if ( str_contains( $revision->post_name, "{$parent_id}-autosave" ) ) {
 318                  $data       = $this->prepare_item_for_response( $revision, $request );
 319                  $response[] = $this->prepare_response_for_collection( $data );
 320              }
 321          }
 322  
 323          return rest_ensure_response( $response );
 324      }
 325  
 326  
 327      /**
 328       * Retrieves the autosave's schema, conforming to JSON Schema.
 329       *
 330       * @since 5.0.0
 331       *
 332       * @return array Item schema data.
 333       */
 334  	public function get_item_schema() {
 335          if ( $this->schema ) {
 336              return $this->add_additional_fields_schema( $this->schema );
 337          }
 338  
 339          $schema = $this->revisions_controller->get_item_schema();
 340  
 341          $schema['properties']['preview_link'] = array(
 342              'description' => __( 'Preview link for the post.' ),
 343              'type'        => 'string',
 344              'format'      => 'uri',
 345              'context'     => array( 'edit' ),
 346              'readonly'    => true,
 347          );
 348  
 349          $this->schema = $schema;
 350  
 351          return $this->add_additional_fields_schema( $this->schema );
 352      }
 353  
 354      /**
 355       * Creates autosave for the specified post.
 356       *
 357       * From wp-admin/post.php.
 358       *
 359       * @since 5.0.0
 360       * @since 6.4.0 The `$meta` parameter was added.
 361       *
 362       * @param array $post_data Associative array containing the post data.
 363       * @param array $meta      Associative array containing the post meta data.
 364       * @return mixed The autosave revision ID or WP_Error.
 365       */
 366  	public function create_post_autosave( $post_data, array $meta = array() ) {
 367  
 368          $post_id = (int) $post_data['ID'];
 369          $post    = get_post( $post_id );
 370  
 371          if ( is_wp_error( $post ) ) {
 372              return $post;
 373          }
 374  
 375          // Only create an autosave when it is different from the saved post.
 376          $autosave_is_different = false;
 377          $new_autosave          = _wp_post_revision_data( $post_data, true );
 378  
 379          foreach ( array_intersect( array_keys( $new_autosave ), array_keys( _wp_post_revision_fields( $post ) ) ) as $field ) {
 380              if ( normalize_whitespace( $new_autosave[ $field ] ) !== normalize_whitespace( $post->$field ) ) {
 381                  $autosave_is_different = true;
 382                  break;
 383              }
 384          }
 385  
 386          // Check if meta values have changed.
 387          if ( ! empty( $meta ) ) {
 388              $revisioned_meta_keys = wp_post_revision_meta_keys( $post->post_type );
 389              foreach ( $revisioned_meta_keys as $meta_key ) {
 390                  // get_metadata_raw is used to avoid retrieving the default value.
 391                  $old_meta = get_metadata_raw( 'post', $post_id, $meta_key, true );
 392                  $new_meta = isset( $meta[ $meta_key ] ) ? $meta[ $meta_key ] : '';
 393  
 394                  if ( $new_meta !== $old_meta ) {
 395                      $autosave_is_different = true;
 396                      break;
 397                  }
 398              }
 399          }
 400  
 401          $user_id = get_current_user_id();
 402  
 403          // Store one autosave per author. If there is already an autosave, overwrite it.
 404          $old_autosave = wp_get_post_autosave( $post_id, $user_id );
 405  
 406          if ( ! $autosave_is_different && $old_autosave ) {
 407              // Nothing to save, return the existing autosave.
 408              return $old_autosave->ID;
 409          }
 410  
 411          if ( $old_autosave ) {
 412              $new_autosave['ID']          = $old_autosave->ID;
 413              $new_autosave['post_author'] = $user_id;
 414  
 415              /** This filter is documented in wp-admin/post.php */
 416              do_action( 'wp_creating_autosave', $new_autosave );
 417  
 418              // wp_update_post() expects escaped array.
 419              $revision_id = wp_update_post( wp_slash( $new_autosave ) );
 420          } else {
 421              // Create the new autosave as a special post revision.
 422              $revision_id = _wp_put_post_revision( $post_data, true );
 423          }
 424  
 425          if ( is_wp_error( $revision_id ) || 0 === $revision_id ) {
 426              return $revision_id;
 427          }
 428  
 429          // Attached any passed meta values that have revisions enabled.
 430          if ( ! empty( $meta ) ) {
 431              foreach ( $revisioned_meta_keys as $meta_key ) {
 432                  if ( isset( $meta[ $meta_key ] ) ) {
 433                      update_metadata( 'post', $revision_id, $meta_key, wp_slash( $meta[ $meta_key ] ) );
 434                  }
 435              }
 436          }
 437  
 438          return $revision_id;
 439      }
 440  
 441      /**
 442       * Prepares the revision for the REST response.
 443       *
 444       * @since 5.0.0
 445       * @since 5.9.0 Renamed `$post` to `$item` to match parent class for PHP 8 named parameter support.
 446       *
 447       * @param WP_Post         $item    Post revision object.
 448       * @param WP_REST_Request $request Request object.
 449       * @return WP_REST_Response Response object.
 450       */
 451  	public function prepare_item_for_response( $item, $request ) {
 452          // Restores the more descriptive, specific name for use within this method.
 453          $post = $item;
 454  
 455          // Don't prepare the response body for HEAD requests.
 456          if ( $request->is_method( 'HEAD' ) ) {
 457              /** This filter is documented in wp-includes/rest-api/endpoints/class-wp-rest-autosaves-controller.php */
 458              return apply_filters( 'rest_prepare_autosave', new WP_REST_Response( array() ), $post, $request );
 459          }
 460          $response = $this->revisions_controller->prepare_item_for_response( $post, $request );
 461          $fields   = $this->get_fields_for_response( $request );
 462  
 463          if ( in_array( 'preview_link', $fields, true ) ) {
 464              $parent_id          = wp_is_post_autosave( $post );
 465              $preview_post_id    = false === $parent_id ? $post->ID : $parent_id;
 466              $preview_query_args = array();
 467  
 468              if ( false !== $parent_id ) {
 469                  $preview_query_args['preview_id']    = $parent_id;
 470                  $preview_query_args['preview_nonce'] = wp_create_nonce( 'post_preview_' . $parent_id );
 471              }
 472  
 473              $response->data['preview_link'] = get_preview_post_link( $preview_post_id, $preview_query_args );
 474          }
 475  
 476          $context        = ! empty( $request['context'] ) ? $request['context'] : 'view';
 477          $response->data = $this->add_additional_fields_to_object( $response->data, $request );
 478          $response->data = $this->filter_response_by_context( $response->data, $context );
 479  
 480          /**
 481           * Filters a revision returned from the REST API.
 482           *
 483           * Allows modification of the revision right before it is returned.
 484           *
 485           * @since 5.0.0
 486           *
 487           * @param WP_REST_Response $response The response object.
 488           * @param WP_Post          $post     The original revision object.
 489           * @param WP_REST_Request  $request  Request used to generate the response.
 490           */
 491          return apply_filters( 'rest_prepare_autosave', $response, $post, $request );
 492      }
 493  
 494      /**
 495       * Retrieves the query params for the autosaves collection.
 496       *
 497       * @since 5.0.0
 498       *
 499       * @return array Collection parameters.
 500       */
 501  	public function get_collection_params() {
 502          return array(
 503              'context' => $this->get_context_param( array( 'default' => 'view' ) ),
 504          );
 505      }
 506  }