<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* REST API Options Controller

[2] Fix | Delete

*

[3] Fix | Delete

* Handles requests to get and update options in the wp_options table.

[4] Fix | Delete

*

[5] Fix | Delete

* IMPORTANT: This API is for legacy support only. DO NOT add new options here. See p90Yrv-2vK-p2#comment-6482 for more details.

[6] Fix | Delete

* For new settings/options, use Settings REST API (https://woocommerce.github.io/woocommerce-rest-api-docs/#setting-option-properties) or create dedicated endpoints instead.

[7] Fix | Delete

*

[8] Fix | Delete

* Example:

[9] Fix | Delete

* - Use register_rest_route() to create a new endpoint

[10] Fix | Delete

* - Follow WooCommerce REST API standards

[11] Fix | Delete

* - Implement proper permission checks

[12] Fix | Delete

* - Add proper documentation

[13] Fix | Delete

* See Automattic\WooCommerce\Admin\API\OnboardingProfile for examples.

[14] Fix | Delete

*/

[15] Fix | Delete

[16] Fix | Delete

declare(strict_types=1);

[17] Fix | Delete

[18] Fix | Delete

namespace Automattic\WooCommerce\Admin\API;

[19] Fix | Delete

[20] Fix | Delete

defined( 'ABSPATH' ) || exit;

[21] Fix | Delete

[22] Fix | Delete

/**

[23] Fix | Delete

* Options Controller.

[24] Fix | Delete

*

[25] Fix | Delete

* @deprecated since 6.2.0

[26] Fix | Delete

*

[27] Fix | Delete

* @extends WC_REST_Data_Controller

[28] Fix | Delete

*/

[29] Fix | Delete

class Options extends \WC_REST_Data_Controller {

[30] Fix | Delete

/**

[31] Fix | Delete

* Endpoint namespace.

[32] Fix | Delete

*

[33] Fix | Delete

* @var string

[34] Fix | Delete

*/

[35] Fix | Delete

protected $namespace = 'wc-admin';

[36] Fix | Delete

[37] Fix | Delete

/**

[38] Fix | Delete

* Route base.

[39] Fix | Delete

*

[40] Fix | Delete

* @var string

[41] Fix | Delete

*/

[42] Fix | Delete

protected $rest_base = 'options';

[43] Fix | Delete

[44] Fix | Delete

/**

[45] Fix | Delete

* Register routes.

[46] Fix | Delete

*/

[47] Fix | Delete

public function register_routes() {

[48] Fix | Delete

register_rest_route(

[49] Fix | Delete

$this->namespace,

[50] Fix | Delete

'/' . $this->rest_base,

[51] Fix | Delete

array(

[52] Fix | Delete

array(

[53] Fix | Delete

'methods' => \WP_REST_Server::READABLE,

[54] Fix | Delete

'callback' => array( $this, 'get_options' ),

[55] Fix | Delete

'permission_callback' => array( $this, 'get_item_permissions_check' ),

[56] Fix | Delete

),

[57] Fix | Delete

'schema' => array( $this, 'get_item_schema' ),

[58] Fix | Delete

)

[59] Fix | Delete

);

[60] Fix | Delete

[61] Fix | Delete

register_rest_route(

[62] Fix | Delete

$this->namespace,

[63] Fix | Delete

'/' . $this->rest_base,

[64] Fix | Delete

array(

[65] Fix | Delete

array(

[66] Fix | Delete

'methods' => \WP_REST_Server::EDITABLE,

[67] Fix | Delete

'callback' => array( $this, 'update_options' ),

[68] Fix | Delete

'permission_callback' => array( $this, 'update_item_permissions_check' ),

[69] Fix | Delete

),

[70] Fix | Delete

'schema' => array( $this, 'get_item_schema' ),

[71] Fix | Delete

)

[72] Fix | Delete

);

[73] Fix | Delete

}

[74] Fix | Delete

[75] Fix | Delete

/**

[76] Fix | Delete

* Check if a given request has access to get options.

[77] Fix | Delete

*

[78] Fix | Delete

* @param WP_REST_Request $request Full details about the request.

[79] Fix | Delete

* @return WP_Error|boolean

[80] Fix | Delete

*/

[81] Fix | Delete

public function get_item_permissions_check( $request ) {

[82] Fix | Delete

$params = ( isset( $request['options'] ) && is_string( $request['options'] ) ) ? explode( ',', $request['options'] ) : array();

[83] Fix | Delete

[84] Fix | Delete

if ( ! $params ) {

[85] Fix | Delete

return new \WP_Error( 'woocommerce_rest_cannot_view', __( 'You must supply an array of options.', 'woocommerce' ), 500 );

[86] Fix | Delete

}

[87] Fix | Delete

[88] Fix | Delete

foreach ( $params as $option ) {

[89] Fix | Delete

if ( ! $this->user_has_permission( $option, $request ) ) {

[90] Fix | Delete

return new \WP_Error( 'woocommerce_rest_cannot_view', __( 'Sorry, you cannot view these options.', 'woocommerce' ), array( 'status' => rest_authorization_required_code() ) );

[91] Fix | Delete

}

[92] Fix | Delete

}

[93] Fix | Delete

[94] Fix | Delete

return true;

[95] Fix | Delete

}

[96] Fix | Delete

[97] Fix | Delete

/**

[98] Fix | Delete

* Check if the user has permission given an option name.

[99] Fix | Delete

*

[100] Fix | Delete

* @param string $option Option name.

[101] Fix | Delete

* @param WP_REST_Request $request Full details about the request.

[102] Fix | Delete

* @param bool $is_update If the request is to update the option.

[103] Fix | Delete

* @return boolean

[104] Fix | Delete

*/

[105] Fix | Delete

public function user_has_permission( $option, $request, $is_update = false ) {

[106] Fix | Delete

$permissions = $this->get_option_permissions( $request );

[107] Fix | Delete

[108] Fix | Delete

if ( isset( $permissions[ $option ] ) ) {

[109] Fix | Delete

return $permissions[ $option ];

[110] Fix | Delete

}

[111] Fix | Delete

[112] Fix | Delete

wc_deprecated_function( 'Automattic\WooCommerce\Admin\API\Options::' . ( $is_update ? 'update_options' : 'get_options' ), '6.3' );

[113] Fix | Delete

[114] Fix | Delete

// Disallow option updates in non-production environments unless the option is whitelisted, prompting developers to create specific endpoints in case they miss the deprecation notice.

[115] Fix | Delete

if ( 'production' !== wp_get_environment_type() ) {

[116] Fix | Delete

return false;

[117] Fix | Delete

}

[118] Fix | Delete

[119] Fix | Delete

return current_user_can( 'manage_options' );

[120] Fix | Delete

}

[121] Fix | Delete

[122] Fix | Delete

/**

[123] Fix | Delete

* Check if a given request has access to update options.

[124] Fix | Delete

*

[125] Fix | Delete

* @param WP_REST_Request $request Full details about the request.

[126] Fix | Delete

* @return WP_Error|boolean

[127] Fix | Delete

*/

[128] Fix | Delete

public function update_item_permissions_check( $request ) {

[129] Fix | Delete

$params = $request->get_json_params();

[130] Fix | Delete

[131] Fix | Delete

if ( ! is_array( $params ) ) {

[132] Fix | Delete

return new \WP_Error( 'woocommerce_rest_cannot_update', __( 'You must supply an array of options and values.', 'woocommerce' ), 500 );

[133] Fix | Delete

}

[134] Fix | Delete

[135] Fix | Delete

foreach ( $params as $option_name => $option_value ) {

[136] Fix | Delete

if ( ! $this->user_has_permission( $option_name, $request, true ) ) {

[137] Fix | Delete

return new \WP_Error( 'woocommerce_rest_cannot_update', __( 'Sorry, you cannot manage these options.', 'woocommerce' ), array( 'status' => rest_authorization_required_code() ) );

[138] Fix | Delete

}

[139] Fix | Delete

}

[140] Fix | Delete

[141] Fix | Delete

return true;

[142] Fix | Delete

}

[143] Fix | Delete

[144] Fix | Delete

/**

[145] Fix | Delete

* Get an array of options and respective permissions for the current user.

[146] Fix | Delete

*

[147] Fix | Delete

* @param WP_REST_Request $request Full details about the request.

[148] Fix | Delete

* @return array

[149] Fix | Delete

*/

[150] Fix | Delete

public function get_option_permissions( $request ) {

[151] Fix | Delete

$permissions = self::get_default_option_permissions();

[152] Fix | Delete

return apply_filters_deprecated( 'woocommerce_rest_api_option_permissions', array( $permissions, $request ), '6.3.0' );

[153] Fix | Delete

}

[154] Fix | Delete

[155] Fix | Delete

/**

[156] Fix | Delete

* Get the default available option permissions.

[157] Fix | Delete

*

[158] Fix | Delete

* @return array

[159] Fix | Delete

*/

[160] Fix | Delete

public static function get_default_option_permissions() {

[161] Fix | Delete

$is_woocommerce_admin = \Automattic\WooCommerce\Internal\Admin\Homescreen::is_admin_user();

[162] Fix | Delete

[163] Fix | Delete

/**

[164] Fix | Delete

* IMPORTANT: This list is frozen for legacy support.

[165] Fix | Delete

* New options MUST use dedicated endpoints instead of being added here.

[166] Fix | Delete

*/

[167] Fix | Delete

$legacy_whitelisted_options = array(

[168] Fix | Delete

'woocommerce_setup_jetpack_opted_in',

[169] Fix | Delete

'woocommerce_stripe_settings',

[170] Fix | Delete

'woocommerce-ppcp-settings',

[171] Fix | Delete

'woocommerce_ppcp-gateway_setting',

[172] Fix | Delete

'woocommerce_demo_store',

[173] Fix | Delete

'woocommerce_demo_store_notice',

[174] Fix | Delete

'woocommerce_ces_tracks_queue',

[175] Fix | Delete

'woocommerce_navigation_intro_modal_dismissed',

[176] Fix | Delete

'woocommerce_shipping_dismissed_timestamp',

[177] Fix | Delete

'woocommerce_allow_tracking',

[178] Fix | Delete

'woocommerce_task_list_keep_completed',

[179] Fix | Delete

'woocommerce_default_homepage_layout',

[180] Fix | Delete

'woocommerce_setup_jetpack_opted_in',

[181] Fix | Delete

'woocommerce_no_sales_tax',

[182] Fix | Delete

'woocommerce_calc_taxes',

[183] Fix | Delete

'woocommerce_bacs_settings',

[184] Fix | Delete

'woocommerce_bacs_accounts',

[185] Fix | Delete

'woocommerce_settings_shipping_recommendations_hidden',

[186] Fix | Delete

'woocommerce_task_list_dismissed_tasks',

[187] Fix | Delete

'woocommerce_setting_payments_recommendations_hidden',

[188] Fix | Delete

'woocommerce_navigation_favorites_tooltip_hidden',

[189] Fix | Delete

'woocommerce_admin_transient_notices_queue',

[190] Fix | Delete

'woocommerce_task_list_hidden',

[191] Fix | Delete

'woocommerce_task_list_complete',

[192] Fix | Delete

'woocommerce_extended_task_list_hidden',

[193] Fix | Delete

'woocommerce_ces_shown_for_actions',

[194] Fix | Delete

'woocommerce_clear_ces_tracks_queue_for_page',

[195] Fix | Delete

'woocommerce_admin_install_timestamp',

[196] Fix | Delete

'woocommerce_task_list_tracked_completed_tasks',

[197] Fix | Delete

'woocommerce_show_marketplace_suggestions',

[198] Fix | Delete

'woocommerce_task_list_reminder_bar_hidden',

[199] Fix | Delete

'wc_connect_options',

[200] Fix | Delete

'woocommerce_admin_created_default_shipping_zones',

[201] Fix | Delete

'woocommerce_admin_reviewed_default_shipping_zones',

[202] Fix | Delete

'woocommerce_admin_reviewed_store_location_settings',

[203] Fix | Delete

'woocommerce_ces_product_feedback_shown',

[204] Fix | Delete

'woocommerce_marketing_overview_multichannel_banner_dismissed',

[205] Fix | Delete

'woocommerce_manage_stock',

[206] Fix | Delete

'woocommerce_dimension_unit',

[207] Fix | Delete

'woocommerce_weight_unit',

[208] Fix | Delete

'woocommerce_product_editor_show_feedback_bar',

[209] Fix | Delete

'woocommerce_single_variation_notice_dismissed',

[210] Fix | Delete

'woocommerce_product_tour_modal_hidden',

[211] Fix | Delete

'woocommerce_block_product_tour_shown',

[212] Fix | Delete

'woocommerce_revenue_report_date_tour_shown',

[213] Fix | Delete

'woocommerce_orders_report_date_tour_shown',

[214] Fix | Delete

'woocommerce_show_prepublish_checks_enabled',

[215] Fix | Delete

'woocommerce_date_type',

[216] Fix | Delete

'date_format',

[217] Fix | Delete

'time_format',

[218] Fix | Delete

'woocommerce_onboarding_profile',

[219] Fix | Delete

'woocommerce_default_country',

[220] Fix | Delete

'blogname',

[221] Fix | Delete

'wcpay_welcome_page_incentives_dismissed',

[222] Fix | Delete

'wcpay_welcome_page_viewed_timestamp',

[223] Fix | Delete

'wcpay_welcome_page_exit_survey_more_info_needed_timestamp',

[224] Fix | Delete

'woocommerce_customize_store_onboarding_tour_hidden',

[225] Fix | Delete

'woocommerce_customize_store_ai_suggestions',

[226] Fix | Delete

'woocommerce_admin_customize_store_completed',

[227] Fix | Delete

'woocommerce_admin_customize_store_completed_theme_id',

[228] Fix | Delete

'woocommerce_admin_customize_store_survey_completed',

[229] Fix | Delete

'woocommerce_coming_soon',

[230] Fix | Delete

'woocommerce_store_pages_only',

[231] Fix | Delete

'woocommerce_private_link',

[232] Fix | Delete

'woocommerce_share_key',

[233] Fix | Delete

'woocommerce_show_lys_tour',

[234] Fix | Delete

'woocommerce_remote_variant_assignment',

[235] Fix | Delete

'woocommerce_gateway_order',

[236] Fix | Delete

'woocommerce_woopayments_nox_profile',

[237] Fix | Delete

// WC Test helper options.

[238] Fix | Delete

'wc-admin-test-helper-rest-api-filters',

[239] Fix | Delete

'wc_admin_helper_feature_values',

[240] Fix | Delete

);

[241] Fix | Delete

[242] Fix | Delete

$theme_permissions = array(

[243] Fix | Delete

'theme_mods_' . get_stylesheet() => current_user_can( 'edit_theme_options' ),

[244] Fix | Delete

'stylesheet' => current_user_can( 'edit_theme_options' ),

[245] Fix | Delete

);

[246] Fix | Delete

[247] Fix | Delete

return array_merge(

[248] Fix | Delete

array_fill_keys( $theme_permissions, current_user_can( 'edit_theme_options' ) ),

[249] Fix | Delete

array_fill_keys( $legacy_whitelisted_options, $is_woocommerce_admin )

[250] Fix | Delete

);

[251] Fix | Delete

}

[252] Fix | Delete

[253] Fix | Delete

/**

[254] Fix | Delete

* Gets an array of options and respective values.

[255] Fix | Delete

*

[256] Fix | Delete

* @param WP_REST_Request $request Full details about the request.

[257] Fix | Delete

* @return array Options object with option values.

[258] Fix | Delete

*/

[259] Fix | Delete

public function get_options( $request ) {

[260] Fix | Delete

$options = array();

[261] Fix | Delete

[262] Fix | Delete

if ( empty( $request['options'] ) || ! is_string( $request['options'] ) ) {

[263] Fix | Delete

return $options;

[264] Fix | Delete

}

[265] Fix | Delete

[266] Fix | Delete

$params = explode( ',', $request['options'] );

[267] Fix | Delete

foreach ( $params as $option ) {

[268] Fix | Delete

$options[ $option ] = get_option( $option );

[269] Fix | Delete

}

[270] Fix | Delete

[271] Fix | Delete

return $options;

[272] Fix | Delete

}

[273] Fix | Delete

[274] Fix | Delete

/**

[275] Fix | Delete

* Updates an array of objects.

[276] Fix | Delete

*

[277] Fix | Delete

* @param WP_REST_Request $request Full details about the request.

[278] Fix | Delete

* @return array Options object with a boolean if the option was updated.

[279] Fix | Delete

*/

[280] Fix | Delete

public function update_options( $request ) {

[281] Fix | Delete

$params = $request->get_json_params();

[282] Fix | Delete

$updated = array();

[283] Fix | Delete

[284] Fix | Delete

if ( ! is_array( $params ) ) {

[285] Fix | Delete

return array();

[286] Fix | Delete

}

[287] Fix | Delete

[288] Fix | Delete

foreach ( $params as $key => $value ) {

[289] Fix | Delete

$updated[ $key ] = update_option( $key, $value );

[290] Fix | Delete

}

[291] Fix | Delete

[292] Fix | Delete

return $updated;

[293] Fix | Delete

}

[294] Fix | Delete

[295] Fix | Delete

/**

[296] Fix | Delete

* Get the schema, conforming to JSON Schema.

[297] Fix | Delete

*

[298] Fix | Delete

* @return array

[299] Fix | Delete

*/

[300] Fix | Delete

public function get_item_schema() {

[301] Fix | Delete

$schema = array(

[302] Fix | Delete

'$schema' => 'http://json-schema.org/draft-04/schema#',

[303] Fix | Delete

'title' => 'options',

[304] Fix | Delete

'type' => 'object',

[305] Fix | Delete

'properties' => array(

[306] Fix | Delete

'options' => array(

[307] Fix | Delete

'type' => 'array',

[308] Fix | Delete

'description' => __( 'Array of options with associated values.', 'woocommerce' ),

[309] Fix | Delete

'context' => array( 'view' ),

[310] Fix | Delete

'readonly' => true,

[311] Fix | Delete

),

[312] Fix | Delete

),

[313] Fix | Delete

);

[314] Fix | Delete

[315] Fix | Delete

return $this->add_additional_fields_schema( $schema );

[316] Fix | Delete

}

[317] Fix | Delete

}

[318] Fix | Delete

[319] Fix | Delete