Support 27947 #2

src/Base/Repositories/AbstractRepository.php

@@ -7,11 +7,11 @@
 namespace OWC\PDC\Base\Repositories;
 
 use Closure;
-use WP_Post;
-use WP_Query;
+use OWC\PDC\Base\Exceptions\PropertyNotExistsException;
 use OWC\PDC\Base\Support\CreatesFields;
 use OWC\PDC\Base\Support\Traits\QueryHelpers;
-use OWC\PDC\Base\Exceptions\PropertyNotExistsException;
+use WP_Post;
+use WP_Query;
 
 /**
  * PDC item object with default quering and methods.
@@ -98,35 +98,29 @@ public function __construct()
 
     /**
      * Get all the items from the database.
-     *
-     * @return array
      */
     public function all(): array
     {
         $args = array_merge($this->queryArgs, [
             'post_type' => [$this->posttype],
         ]);
 
-        $this->query = new WP_Query($args);
+        $this->query = new WP_Query($this->validatePostStatusParam($args));
 
         return array_map([$this, 'transform'], $this->getQuery()->posts);
     }
 
     /**
      * Find a particular pdc item by ID.
-     *
-     * @param int $id
-     *
-     * @return array
      */
-    public function find(int $id)
+    public function find(int $id): ?array
     {
         $args = array_merge($this->queryArgs, [
             'p' => $id,
             'post_type' => [$this->posttype],
         ]);
 
-        $this->query = new WP_Query($args);
+        $this->query = new WP_Query($this->validatePostStatusParam($args));
 
         if (empty($this->getQuery()->posts)) {
             return null;
@@ -137,19 +131,15 @@ public function find(int $id)
 
     /**
      * Find a particular pdc item by slug.
-     *
-     * @param string $slug
-     *
-     * @return array|null
      */
-    public function findBySlug(string $slug)
+    public function findBySlug(string $slug): ?array
     {
         $args = array_merge($this->queryArgs, [
             'name' => $slug,
             'post_type' => [$this->posttype],
         ]);
 
-        $this->query = new WP_Query($args);
+        $this->query = new WP_Query($this->validatePostStatusParam($args));
 
         if (empty($this->getQuery()->posts)) {
             return null;
@@ -158,6 +148,29 @@ public function findBySlug(string $slug)
         return $this->transform(reset($this->getQuery()->posts));
     }
 
+    protected function validatePostStatusParam(array $args): array
+    {
+        if (empty($args['post_status'])) {
+            return $args;
+        }
+
+        if (! is_string($args['post_status']) && ! is_array($args['post_status'])) {
+            unset($args['post_status']);
+
+            return $args;
+        }
+
+        if (is_string($args['post_status'])) {
+            $args['post_status'] = [$args['post_status']];
+        }
+
+        if (! \is_user_logged_in()) {
+            $args['post_status'] = ['publish'];
+        }
+
+        return $args;
+    }
+
     /**
      * Get the WP_Query object.
      *
@@ -273,7 +286,7 @@ public function transform(WP_Post $post)
             'date' => $post->post_date,
             'slug' => $post->post_name,
             'post_status' => $post->post_status,
-            'protected' => ! $this->isAllowed($post)
+            'protected' => ! $this->isAllowed($post),
         ];
 
         $data = $this->assignFields($data, $post);

src/Base/RestAPI/Controllers/BaseController.php

@@ -6,9 +6,9 @@
 
 namespace OWC\PDC\Base\RestAPI\Controllers;
 
+use OWC\PDC\Base\Foundation\Plugin;
 use WP_Query;
 use WP_REST_Request;
-use OWC\PDC\Base\Foundation\Plugin;
 
 /**
  * Controller which handels general quering, such as pagination.
@@ -39,14 +39,14 @@ protected function addPaginator(array $data, WP_Query $query): array
         $page = 0 == $page ? 1 : $page;
 
         return array_merge([
-            'data' => $data
+            'data' => $data,
         ], [
             'pagination' => [
-                'total_count' => (int) $query->found_posts,
-                'total_pages' => $query->max_num_pages,
+                'total_count'  => (int) $query->found_posts,
+                'total_pages'  => $query->max_num_pages,
                 'current_page' => $page,
-                'limit' => $query->get('posts_per_page')
-            ]
+                'limit'        => $query->get('posts_per_page'),
+            ],
         ]);
     }
 
@@ -57,7 +57,7 @@ protected function getPaginatorParams(WP_REST_Request $request, int $limit = 10)
     {
         return [
             'posts_per_page' => $request->get_param('limit') ?: $limit,
-            'paged' => $request->get_param('page') ?: 0
+            'paged'          => $request->get_param('page') ?: 0,
         ];
     }
 

src/Base/RestAPI/Controllers/ItemController.php

@@ -50,22 +50,40 @@ public function getItems(WP_REST_Request $request): array
      */
     protected function convertParameters(array $parametersFromRequest): array
     {
-        $parameters = [];
-
-        if (isset($parametersFromRequest['name'])) {
-            $parameters['name'] = esc_attr($parametersFromRequest['name']);
+        $allowedQueryParams = [
+            'name',
+            'include-connected',
+            'slug',
+            'id',
+            'p',
+            'tax_query',
+            'meta_query',
+            'post_type',
+            'post_status',
+        ];
+
+        $parameters = array_filter(
+            $parametersFromRequest,
+            static function ($param) use ($allowedQueryParams) {
+                return in_array($param, $allowedQueryParams, true);
+            },
+            ARRAY_FILTER_USE_KEY
+        );
+
+        if (isset($parameters['name'])) {
+            $parameters['name'] = esc_attr($parameters['name']);
         }
 
-        $parameters['include-connected'] = (isset($parametersFromRequest['include-connected'])) ? true : false;
+        $parameters['include-connected'] = (isset($parameters['include-connected'])) ? true : false;
 
-        if (isset($parametersFromRequest['slug'])) {
-            $parameters['name'] = esc_attr($parametersFromRequest['slug']);
-            unset($parametersFromRequest['slug']);
+        if (isset($parameters['slug'])) {
+            $parameters['name'] = esc_attr($parameters['slug']);
+            unset($parameters['slug']);
         }
 
-        if (isset($parametersFromRequest['id'])) {
-            $parameters['p'] = absint($parametersFromRequest['id']);
-            unset($parametersFromRequest['slug']);
+        if (isset($parameters['id'])) {
+            $parameters['p'] = absint($parameters['id']);
+            unset($parameters['id']);
         }
 
         return $parameters;

src/Base/RestAPI/SharedFields/ItemsField.php

@@ -6,10 +6,10 @@
 
 namespace OWC\PDC\Base\RestAPI\SharedFields;
 
-use WP_Post;
-use OWC\PDC\Base\Support\Traits\QueryHelpers;
-use OWC\PDC\Base\Support\Traits\CheckPluginActive;
 use OWC\PDC\Base\RestAPI\ItemFields\ConnectedField;
+use OWC\PDC\Base\Support\Traits\CheckPluginActive;
+use OWC\PDC\Base\Support\Traits\QueryHelpers;
+use WP_Post;
 
 /**
  * Adds connected fields to item in API.
@@ -43,8 +43,12 @@ protected function extraQueryArgs(string $type): array
             $query = array_merge_recursive($query, $this->filterShowOnTaxonomyQuery($this->source));
         }
 
+        $postStatus = \is_user_logged_in()
+            ? ['publish', 'draft']
+            : ['publish'];
+
         $query['connected_query'] = [
-            'post_status' => ['publish', 'draft'],
+            'post_status' => $postStatus,
         ];
 
         return $query;