Skip to content

Commit ee0cfcf

Browse files
pattonwebzpattonwebz
authored
Merge pull request #1206 from equalizedigital/william/no-ticket/enhance-endpoint-checks
Backport v1.30.1
2 parents dd032c4 + 3456ce5 commit ee0cfcf

8 files changed

Lines changed: 269 additions & 21 deletions

File tree

‎accessibility-checker.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Plugin Name: Accessibility Checker
1111
* Plugin URI: https://a11ychecker.com
1212
* Description: Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.
13-
* Version: 1.30.0
13+
* Version: 1.30.1
1414
* Requires PHP: 7.4
1515
* Author: Equalize Digital
1616
* Author URI: https://equalizedigital.com
@@ -36,7 +36,7 @@
3636

3737
// Current plugin version.
3838
if ( ! defined( 'EDAC_VERSION' ) ) {
39-
define( 'EDAC_VERSION', '1.30.0' );
39+
define( 'EDAC_VERSION', '1.30.1' );
4040
}
4141

4242
// Current database version.
@@ -122,7 +122,7 @@ function edac_register_rules() {
122122

123123
// Use the new class-based rules system.
124124
$default_rules = \EqualizeDigital\AccessibilityChecker\Rules\RuleRegistry::load_rules();
125-
125+
126126
/**
127127
* Filter the default rules.
128128
*

‎admin/class-welcome-page.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,11 @@ public static function render_summary() {
4040
</div>
4141

4242
<p class="edac-cols-right">
43-
<button class="button" id="edac_clear_cached_stats">
44-
<?php esc_html_e( 'Update Counts', 'accessibility-checker' ); ?>
45-
</button>
43+
<?php if ( current_user_can( 'publish_posts' ) ) : ?>
44+
<button class="button" id="edac_clear_cached_stats">
45+
<?php esc_html_e( 'Update Counts', 'accessibility-checker' ); ?>
46+
</button>
47+
<?php endif; ?>
4648

4749
<a class="edac-ml-1 button" href="<?php echo esc_url( admin_url( 'admin.php?page=accessibility_checker_full_site_scan' ) ); ?>">
4850
<?php esc_html_e( 'Start New Scan', 'accessibility-checker' ); ?>

‎includes/classes/class-enqueue-frontend.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ public static function maybe_enqueue_frontend_highlighter() {
101101
'nonce' => wp_create_nonce( 'ajax-nonce' ),
102102
'restNonce' => wp_create_nonce( 'wp_rest' ),
103103
'userCanFix' => current_user_can( apply_filters( 'edac_filter_settings_capability', 'manage_options' ) ),
104+
'userCanEdit' => current_user_can( 'edit_post', $post_id ),
104105
'edacUrl' => esc_url_raw( get_site_url() ),
105106
'ajaxurl' => admin_url( 'admin-ajax.php' ),
106107
'loggedIn' => is_user_logged_in(),

‎includes/classes/class-rest-api.php‎

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -79,13 +79,15 @@ function () use ( $ns, $version ) {
7979
'callback' => [ $this, 'set_post_scan_results' ],
8080
'args' => [
8181
'id' => [
82+
'required' => true,
8283
'validate_callback' => function ( $param ) {
8384
return is_numeric( $param );
8485
},
86+
'sanitize_callback' => 'absint',
8587
],
8688
],
87-
'permission_callback' => function () {
88-
return current_user_can( 'edit_posts' );
89+
'permission_callback' => function ( $request ) {
90+
return $this->user_can_edit_passed_post_id( $request );
8991
},
9092
]
9193
);
@@ -102,7 +104,7 @@ function () use ( $ns, $version ) {
102104
'methods' => 'GET',
103105
'callback' => [ $this, 'get_scans_stats' ],
104106
'permission_callback' => function () {
105-
return current_user_can( 'read' ); // able to access the admin dashboard.
107+
return current_user_can( 'edit_posts' );
106108
},
107109
]
108110
);
@@ -119,7 +121,7 @@ function () use ( $ns, $version ) {
119121
'methods' => 'POST',
120122
'callback' => [ $this, 'clear_cached_scans_stats' ],
121123
'permission_callback' => function () {
122-
return current_user_can( 'read' ); // able to access the admin dashboard.
124+
return current_user_can( 'publish_posts' );
123125
},
124126
]
125127
);
@@ -136,7 +138,7 @@ function () use ( $ns, $version ) {
136138
'methods' => 'GET',
137139
'callback' => [ $this, 'get_scans_stats_by_post_type' ],
138140
'permission_callback' => function () {
139-
return current_user_can( 'read' ); // able to access the admin dashboard.
141+
return current_user_can( 'edit_posts' );
140142
},
141143
]
142144
);
@@ -153,7 +155,7 @@ function () use ( $ns, $version ) {
153155
'methods' => 'GET',
154156
'callback' => [ $this, 'get_scans_stats_by_post_types' ],
155157
'permission_callback' => function () {
156-
return current_user_can( 'read' ); // able to access the admin dashboard.
158+
return current_user_can( 'edit_posts' );
157159
},
158160
]
159161
);
@@ -171,13 +173,15 @@ function () use ( $ns, $version ) {
171173
'callback' => [ $this, 'clear_issues_for_post' ],
172174
'args' => [
173175
'id' => [
176+
'required' => true,
174177
'validate_callback' => function ( $param ) {
175178
return is_numeric( $param );
176179
},
180+
'sanitize_callback' => 'absint',
177181
],
178182
],
179-
'permission_callback' => function () {
180-
return current_user_can( 'edit_posts' );
183+
'permission_callback' => function ( $request ) {
184+
return $this->user_can_edit_passed_post_id( $request );
181185
},
182186
]
183187
);
@@ -203,10 +207,29 @@ function () use ( $ns, $version ) {
203207
);
204208
}
205209

210+
/**
211+
* Check if the user can edit a post.
212+
*
213+
* This is a permission callback to replace several places where we check if the user can edit a post.
214+
*
215+
* @since 1.30.1
216+
*
217+
* @param \WP_REST_Request $request The request object passed from the REST call. This should contain the 'id' of the post to check permissions for.
218+
*
219+
* @return bool|\WP_Error
220+
*/
221+
public function user_can_edit_passed_post_id( $request ) {
222+
if ( ! isset( $request['id'] ) ) {
223+
return new \WP_Error( 'rest_post_invalid_id', __( 'A required parameter is missing.', 'accessibility-checker' ), [ 'status' => 400 ] );
224+
}
225+
$post_id = (int) $request['id'];
226+
return current_user_can( 'edit_post', $post_id ); // able to edit the post.
227+
}
228+
206229
/**
207230
* REST handler to clear issues results for a given post ID.
208231
*
209-
* @param WP_REST_Request $request The request passed from the REST call.
232+
* @param \WP_REST_Request $request The request passed from the REST call.
210233
*
211234
* @return \WP_REST_Response
212235
*/

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "accessibility-checker",
3-
"version": "1.30.0",
3+
"version": "1.30.1",
44
"description": "Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.",
55
"author": "Equalize Digital",
66
"license": "GPL-2.0+",

‎readme.txt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Contributors: equalizedigital, alh0319, stevejonesdev
33
Tags: accessibility, accessible, wcag, ada, WP accessibility
44
Requires at least: 6.6
55
Tested up to: 6.8
6-
Stable tag: 1.30.0
6+
Stable tag: 1.30.1
77
License: GPLv2 or later
88
License URI: http://www.gnu.org/licenses/gpl-2.0.html
99

@@ -211,6 +211,10 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
211211

212212
== Changelog ==
213213

214+
= 1.30.1 =
215+
* Improved: The rescan and clear buttons in the frontend highlighter are now only shown when they can be used.
216+
* Improved: Issue saving and clearing now has more robust capability checking.
217+
214218
= 1.30.0 =
215219
* Added: Ability to clear issues on a post or page from the frontend highlighter.
216220
* Added: More accessibility checker details in the site health check.

‎src/frontendHighlighterApp/index.js‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -394,12 +394,12 @@ class AccessibilityCheckerHighlight {
394394
addHighlightPanel() {
395395
const widgetPosition = edacFrontendHighlighterApp?.widgetPosition || 'right';
396396

397-
const isLoggedInUser = edacFrontendHighlighterApp && edacFrontendHighlighterApp?.loggedIn;
398-
const clearButtonMarkup = isLoggedInUser
397+
const userCanEdit = edacFrontendHighlighterApp && edacFrontendHighlighterApp?.userCanEdit && edacFrontendHighlighterApp?.loggedIn;
398+
const clearButtonMarkup = userCanEdit
399399
? `<button id="edac-highlight-clear-issues" class="edac-highlight-clear-issues">${ __( 'Clear Issues', 'accessibility-checker' ) }</button>`
400400
: '';
401401

402-
const rescanButton = isLoggedInUser
402+
const rescanButton = userCanEdit
403403
? `<button id="edac-highlight-rescan" class="edac-highlight-rescan">${ __( 'Rescan This Page', 'accessibility-checker' ) }</button>`
404404
: '';
405405

@@ -416,7 +416,7 @@ class AccessibilityCheckerHighlight {
416416
<button id="edac-highlight-panel-controls-close" class="edac-highlight-panel-controls-close" aria-label="Close">×</button>
417417
<div class="edac-highlight-panel-controls-title">Accessibility Checker</div>
418418
<div class="edac-highlight-panel-controls-summary">Loading...</div>
419-
<div class="edac-highlight-panel-controls-buttons ${ ! isLoggedInUser ? ' single_button' : '' }">
419+
<div class="edac-highlight-panel-controls-buttons ${ ! userCanEdit ? ' single_button' : '' }">
420420
<div>
421421
<button id="edac-highlight-previous" disabled="true"><span aria-hidden="true">« </span>Previous</button>
422422
<button id="edac-highlight-next" disabled="true">Next<span aria-hidden="true"> »</span></button><br />

0 commit comments

Comments
 (0)