<?php

/**

 * REST API: WP_REST_Server class

 *

 * @package WordPress

 * @subpackage REST_API

 * @since 4.4.0

 */

/**

 * Core class used to implement the WordPress REST API server.

 *

 * @since 4.4.0

 */

class WP_REST_Server {

	/**

	 * Alias for GET transport method.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const READABLE = 'GET';

	/**

	 * Alias for POST transport method.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const CREATABLE = 'POST';

	/**

	 * Alias for POST, PUT, PATCH transport methods together.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const EDITABLE = 'POST, PUT, PATCH';

	/**

	 * Alias for DELETE transport method.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const DELETABLE = 'DELETE';

	/**

	 * Alias for GET, POST, PUT, PATCH & DELETE transport methods together.

	 *

	 * @since 4.4.0

	 * @var string

	 */

	const ALLMETHODS = 'GET, POST, PUT, PATCH, DELETE';

	/**

	 * Namespaces registered to the server.

	 *

	 * @since 4.4.0

	 * @var array

	 */

	protected $namespaces = array();

	/**

	 * Endpoints registered to the server.

	 *

	 * @since 4.4.0

	 * @var array

	 */

	protected $endpoints = array();

	/**

	 * Options defined for the routes.

	 *

	 * @since 4.4.0

	 * @var array

	 */

	protected $route_options = array();

	/**

	 * Caches embedded requests.

	 *

	 * @since 5.4.0

	 * @var array

	 */

	protected $embed_cache = array();

	/**

	 * Instantiates the REST server.

	 *

	 * @since 4.4.0

	 */

	public function __construct() {

		$this->endpoints = array(

			// Meta endpoints.

				'callback' => array( $this, 'get_index' ),

				'methods'  => 'GET',

				'args'     => array(

					'context' => array(

						'default' => 'view',

					),

				),

			),

		);

	}

	/**

	 * Checks the authentication headers if supplied.

	 *

	 * @since 4.4.0

	 *

	 * @return WP_Error|null WP_Error indicates unsuccessful login, null indicates successful

	 *                       or no authentication provided

	 */

	public function check_authentication() {

		/**

		 *

		 * This is used to pass a WP_Error from an authentication method back to

		 * the API.

		 *

		 * Authentication methods should check first if they're being used, as

		 * multiple authentication methods can be enabled on a site (cookies,

		 * HTTP basic auth, OAuth). If the authentication method hooked in is

		 * not actually being attempted, null should be returned to indicate

		 * another authentication method should check instead. Similarly,

		 * callbacks should ensure the value is `null` before checking for

		 * errors.

		 *

		 * A WP_Error instance can be returned if an error occurs, and this should

		 * match the format used by API methods internally (that is, the `status`

		 * data should be used). A callback can return `true` to indicate that

		 * the authentication method was used, and it succeeded.

		 *

		 * @since 4.4.0

		 *

		 * @param WP_Error|null|true $errors WP_Error if authentication error, null if authentication

		 *                                   method wasn't used, true if authentication succeeded.

		 */

		return apply_filters( 'rest_authentication_errors', null );

	}

	/**

	 * Converts an error to a response object.

	 *

	 * This iterates over all error codes and messages to change it into a flat

	 * array. This enables simpler client behaviour, as it is represented as a

	 * list in JSON rather than an object/map.

	 *

	 * @since 4.4.0

	 *

	 * @param WP_Error $error WP_Error instance.

	 * @return WP_REST_Response List of associative arrays with code and message keys.

	 */

	protected function error_to_response( $error ) {

	}

	/**

	 * Retrieves an appropriate error representation in JSON.

	 *

	 * Note: This should only be used in WP_REST_Server::serve_request(), as it

	 * cannot handle WP_Error internally. All callbacks and other internal methods

	 * should instead return a WP_Error with the data set to an array that includes

	 * a 'status' key, with the value being the HTTP status to send.

	 *

	 * @since 4.4.0

	 *

	 * @param string $code    WP_Error-style code.

	 * @param string $message Human-readable message.

	 * @param int    $status  Optional. HTTP status code to send. Default null.

	 * @return string JSON representation of the error

	 */

	protected function json_error( $code, $message, $status = null ) {

		if ( $status ) {

			$this->set_status( $status );

		}

		$error = compact( 'code', 'message' );

		return wp_json_encode( $error );

	}

	/**

	 *

	 * Matches the current server URI to a route and runs the first matching

	 * callback then outputs a JSON representation of the returned value.

	 *

	 * @since 4.4.0

	 *

	 * @see WP_REST_Server::dispatch()

	 *

	 * @param string $path Optional. The request route. If not set, `$_SERVER['PATH_INFO']` will be used.

	 *                     Default null.

	 * @return null|false Null if not served and a HEAD request, false otherwise.

	 */

	public function serve_request( $path = null ) {

		$this->send_header( 'Content-Type', $content_type . '; charset=' . get_option( 'blog_charset' ) );

		$this->send_header( 'X-Robots-Tag', 'noindex' );

		$api_root = get_rest_url();

		if ( ! empty( $api_root ) ) {

			$this->send_header( 'Link', '<' . esc_url_raw( $api_root ) . '>; rel="https://api.w.org/"' );

		}

		/*

		 * Mitigate possible JSONP Flash attacks.

		 *

		 * https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

		 */

		$this->send_header( 'X-Content-Type-Options', 'nosniff' );

		$expose_headers = array( 'X-WP-Total', 'X-WP-TotalPages', 'Link' );

		/**

		 *

		 * @since 5.5.0

		 *

		 */

		$expose_headers = apply_filters( 'rest_exposed_cors_headers', $expose_headers );

		$this->send_header( 'Access-Control-Expose-Headers', implode( ', ', $expose_headers ) );

		$allow_headers = array(

			'Authorization',

			'X-WP-Nonce',

			'Content-Disposition',

			'Content-MD5',

			'Content-Type',

		);

		/**

		 *

		 * The allowed headers are passed to the browser to specify which

		 * headers can be passed to the REST API. By default, we allow the

		 * Content-* headers needed to upload files to the media endpoints.

		 * As well as the Authorization and Nonce headers for allowing authentication.

		 *

		 * @since 5.5.0

		 *

		 */

		$allow_headers = apply_filters( 'rest_allowed_cors_headers', $allow_headers );

		$this->send_header( 'Access-Control-Allow-Headers', implode( ', ', $allow_headers ) );

		/**

		 *

		 * @since 4.4.0

		 *

		 * @param bool $rest_send_nocache_headers Whether to send no-cache headers.

		 */

		$send_no_cache_headers = apply_filters( 'rest_send_nocache_headers', is_user_logged_in() );

		if ( $send_no_cache_headers ) {

			foreach ( wp_get_nocache_headers() as $header => $header_value ) {

				if ( empty( $header_value ) ) {

					$this->remove_header( $header );

				} else {

					$this->send_header( $header, $header_value );

				}

			}

		}

		/**

		 * Filters whether the REST API is enabled.

		 *

		 * @since 4.4.0

		 * @deprecated 4.7.0 Use the {@see 'rest_authentication_errors'} filter to

		 *

		 * @param bool $rest_enabled Whether the REST API is enabled. Default true.

		 */

		apply_filters_deprecated(

			'rest_enabled',

			array( true ),

			'4.7.0',

			'rest_authentication_errors',

			sprintf(

				/* translators: %s: rest_authentication_errors */

				__( 'The REST API can no longer be completely disabled, the %s filter can be used to restrict access to the API, instead.' ),

				'rest_authentication_errors'

			)

		);

			if ( ! $jsonp_enabled ) {

				echo $this->json_error( 'rest_callback_disabled', __( 'JSONP support is disabled on this site.' ), 400 );

				return false;

			}

			if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {

				echo $this->json_error( 'rest_callback_invalid', __( 'Invalid JSONP callback function.' ), 400 );

				return false;

			}

		}

		if ( empty( $path ) ) {

			if ( isset( $_SERVER['PATH_INFO'] ) ) {

				$path = $_SERVER['PATH_INFO'];

			} else {

				$path = '/';

			}

		}

		$request = new WP_REST_Request( $_SERVER['REQUEST_METHOD'], $path );

		$request->set_query_params( wp_unslash( $_GET ) );

		$request->set_body_params( wp_unslash( $_POST ) );

		$request->set_file_params( $_FILES );

		$request->set_headers( $this->get_headers( wp_unslash( $_SERVER ) ) );

		$request->set_body( self::get_raw_data() );

		/*

		 * HTTP method override for clients that can't use PUT/PATCH/DELETE. First, we check

		 * $_GET['_method']. If that is not set, we check for the HTTP_X_HTTP_METHOD_OVERRIDE

		 * header.

		 */

		if ( isset( $_GET['_method'] ) ) {

			$request->set_method( $_GET['_method'] );

		} elseif ( isset( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] ) ) {

			$request->set_method( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] );

		}

		$result = $this->check_authentication();

		if ( ! is_wp_error( $result ) ) {

			$result = $this->dispatch( $request );

		}

		// Normalize to either WP_Error or WP_REST_Response...

		$result = rest_ensure_response( $result );

		// ...then convert WP_Error across.

		if ( is_wp_error( $result ) ) {

			$result = $this->error_to_response( $result );

		}

		/**

		 *

		 * Allows modification of the response before returning.

		 *

		 * @since 4.4.0

		 * @since 4.5.0 Applied to embedded responses.

		 *

		 * @param WP_REST_Request  $request Request used to generate the response.

		 */

		$result = apply_filters( 'rest_post_dispatch', rest_ensure_response( $result ), $this, $request );

		// Wrap the response in an envelope if asked for.

		if ( isset( $_GET['_envelope'] ) ) {

			$result = $this->envelope_response( $result, isset( $_GET['_embed'] ) );

		}