1 <?php

     2 /**

     3  * REST API: WP_REST_Posts_Controller class

     4  *

     5  * @package WordPress

     6  * @subpackage REST_API

     7  * @since 4.7.0

     8  */

     9 

    10 /**

    11  * Core class to access posts via the REST API.

    12  *

    13  * @since 4.7.0

    14  *

    15  * @see WP_REST_Controller

    16  */

    17 class WP_REST_Posts_Controller extends WP_REST_Controller {

    18 

    19 	/**

    20 	 * Post type.

    21 	 *

    22 	 * @since 4.7.0

    23 	 * @var string

    24 	 */

    25 	protected $post_type;

    26 

    27 	/**

    28 	 * Instance of a post meta fields object.

    29 	 *

    30 	 * @since 4.7.0

    31 	 * @var WP_REST_Post_Meta_Fields

    32 	 */

    33 	protected $meta;

    34 

    35 	/**

    36 	 * Constructor.

    37 	 *

    38 	 * @since 4.7.0

    39 	 *

    40 	 * @param string $post_type Post type.

    41 	 */

    42 	public function __construct( $post_type ) {

    43 		$this->post_type = $post_type;

    44 		$this->namespace = 'wp/v2';

    45 		$obj = get_post_type_object( $post_type );

    46 		$this->rest_base = ! empty( $obj->rest_base ) ? $obj->rest_base : $obj->name;

    47 

    48 		$this->meta = new WP_REST_Post_Meta_Fields( $this->post_type );

    49 	}

    50 

    51 	/**

    52 	 * Registers the routes for the objects of the controller.

    53 	 *

    54 	 * @since 4.7.0

    55 	 *

    56 	 * @see register_rest_route()

    57 	 */

    58 	public function register_routes() {

    59 

    60 		register_rest_route( $this->namespace, '/' . $this->rest_base, array(

    61 			array(

    62 				'methods'             => WP_REST_Server::READABLE,

    63 				'callback'            => array( $this, 'get_items' ),

    64 				'permission_callback' => array( $this, 'get_items_permissions_check' ),

    65 				'args'                => $this->get_collection_params(),

    66 			),

    67 			array(

    68 				'methods'             => WP_REST_Server::CREATABLE,

    69 				'callback'            => array( $this, 'create_item' ),

    70 				'permission_callback' => array( $this, 'create_item_permissions_check' ),

    71 				'args'                => $this->get_endpoint_args_for_item_schema( WP_REST_Server::CREATABLE ),

    72 			),

    73 			'schema' => array( $this, 'get_public_item_schema' ),

    74 		) );

    75 

    76 		$schema = $this->get_item_schema();

    77 		$get_item_args = array(

    78 			'context'  => $this->get_context_param( array( 'default' => 'view' ) ),

    79 		);

    80 		if ( isset( $schema['properties']['password'] ) ) {

    81 			$get_item_args['password'] = array(

    82 				'description' => __( 'The password for the post if it is password protected.' ),

    83 				'type'        => 'string',

    84 			);

    85 		}

    86 		register_rest_route( $this->namespace, '/' . $this->rest_base . '/(?P<id>[\d]+)', array(

    87 			'args' => array(

    88 				'id' => array(

    89 					'description' => __( 'Unique identifier for the object.' ),

    90 					'type'        => 'integer',

    91 				),

    92 			),

    93 			array(

    94 				'methods'             => WP_REST_Server::READABLE,

    95 				'callback'            => array( $this, 'get_item' ),

    96 				'permission_callback' => array( $this, 'get_item_permissions_check' ),

    97 				'args'                => $get_item_args,

    98 			),

    99 			array(

   100 				'methods'             => WP_REST_Server::EDITABLE,

   101 				'callback'            => array( $this, 'update_item' ),

   102 				'permission_callback' => array( $this, 'update_item_permissions_check' ),

   103 				'args'                => $this->get_endpoint_args_for_item_schema( WP_REST_Server::EDITABLE ),

   104 			),

   105 			array(

   106 				'methods'             => WP_REST_Server::DELETABLE,

   107 				'callback'            => array( $this, 'delete_item' ),

   108 				'permission_callback' => array( $this, 'delete_item_permissions_check' ),

   109 				'args'                => array(

   110 					'force' => array(

   111 						'type'        => 'boolean',

   112 						'default'     => false,

   113 						'description' => __( 'Whether to bypass trash and force deletion.' ),

   114 					),

   115 				),

   116 			),

   117 			'schema' => array( $this, 'get_public_item_schema' ),

   118 		) );

   119 	}

   120 

   121 	/**

   122 	 * Checks if a given request has access to read posts.

   123 	 *

   124 	 * @since 4.7.0

   125 	 *

   126 	 * @param  WP_REST_Request $request Full details about the request.

   127 	 * @return true|WP_Error True if the request has read access, WP_Error object otherwise.

   128 	 */

   129 	public function get_items_permissions_check( $request ) {

   130 

   131 		$post_type = get_post_type_object( $this->post_type );

   132 

   133 		if ( 'edit' === $request['context'] && ! current_user_can( $post_type->cap->edit_posts ) ) {

   134 			return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );

   135 		}

   136 

   137 		return true;

   138 	}

   139 

   140 	/**

   141 	 * Retrieves a collection of posts.

   142 	 *

   143 	 * @since 4.7.0

   144 	 *

   145 	 * @param WP_REST_Request $request Full details about the request.

   146 	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

   147 	 */

   148 	public function get_items( $request ) {

   149 

   150 		// Ensure a search string is set in case the orderby is set to 'relevance'.

   151 		if ( ! empty( $request['orderby'] ) && 'relevance' === $request['orderby'] && empty( $request['search'] ) ) {

   152 			return new WP_Error( 'rest_no_search_term_defined', __( 'You need to define a search term to order by relevance.' ), array( 'status' => 400 ) );

   153 		}

   154 

   155 		// Ensure an include parameter is set in case the orderby is set to 'include'.

   156 		if ( ! empty( $request['orderby'] ) && 'include' === $request['orderby'] && empty( $request['include'] ) ) {

   157 			return new WP_Error( 'rest_orderby_include_missing_include', __( 'You need to define an include parameter to order by include.' ), array( 'status' => 400 ) );

   158 		}

   159 

   160 		// Retrieve the list of registered collection query parameters.

   161 		$registered = $this->get_collection_params();

   162 		$args = array();

   163 

   164 		/*

   165 		 * This array defines mappings between public API query parameters whose

   166 		 * values are accepted as-passed, and their internal WP_Query parameter

   167 		 * name equivalents (some are the same). Only values which are also

   168 		 * present in $registered will be set.

   169 		 */

   170 		$parameter_mappings = array(

   171 			'author'         => 'author__in',

   172 			'author_exclude' => 'author__not_in',

   173 			'exclude'        => 'post__not_in',

   174 			'include'        => 'post__in',

   175 			'menu_order'     => 'menu_order',

   176 			'offset'         => 'offset',

   177 			'order'          => 'order',

   178 			'orderby'        => 'orderby',

   179 			'page'           => 'paged',

   180 			'parent'         => 'post_parent__in',

   181 			'parent_exclude' => 'post_parent__not_in',

   182 			'search'         => 's',

   183 			'slug'           => 'post_name__in',

   184 			'status'         => 'post_status',

   185 		);

   186 

   187 		/*

   188 		 * For each known parameter which is both registered and present in the request,

   189 		 * set the parameter's value on the query $args.

   190 		 */

   191 		foreach ( $parameter_mappings as $api_param => $wp_param ) {

   192 			if ( isset( $registered[ $api_param ], $request[ $api_param ] ) ) {

   193 				$args[ $wp_param ] = $request[ $api_param ];

   194 			}

   195 		}

   196 

   197 		// Check for & assign any parameters which require special handling or setting.

   198 		$args['date_query'] = array();

   199 

   200 		// Set before into date query. Date query must be specified as an array of an array.

   201 		if ( isset( $registered['before'], $request['before'] ) ) {

   202 			$args['date_query'][0]['before'] = $request['before'];

   203 		}

   204 

   205 		// Set after into date query. Date query must be specified as an array of an array.

   206 		if ( isset( $registered['after'], $request['after'] ) ) {

   207 			$args['date_query'][0]['after'] = $request['after'];

   208 		}

   209 

   210 		// Ensure our per_page parameter overrides any provided posts_per_page filter.

   211 		if ( isset( $registered['per_page'] ) ) {

   212 			$args['posts_per_page'] = $request['per_page'];

   213 		}

   214 

   215 		if ( isset( $registered['sticky'], $request['sticky'] ) ) {

   216 			$sticky_posts = get_option( 'sticky_posts', array() );

   217 			if ( ! is_array( $sticky_posts ) ) {

   218 				$sticky_posts = array();

   219 			}

   220 			if ( $request['sticky'] ) {

   221 				/*

   222 				 * As post__in will be used to only get sticky posts,

   223 				 * we have to support the case where post__in was already

   224 				 * specified.

   225 				 */

   226 				$args['post__in'] = $args['post__in'] ? array_intersect( $sticky_posts, $args['post__in'] ) : $sticky_posts;

   227 

   228 				/*

   229 				 * If we intersected, but there are no post ids in common,

   230 				 * WP_Query won't return "no posts" for post__in = array()

   231 				 * so we have to fake it a bit.

   232 				 */

   233 				if ( ! $args['post__in'] ) {

   234 					$args['post__in'] = array( 0 );

   235 				}

   236 			} elseif ( $sticky_posts ) {

   237 				/*

   238 				 * As post___not_in will be used to only get posts that

   239 				 * are not sticky, we have to support the case where post__not_in

   240 				 * was already specified.

   241 				 */

   242 				$args['post__not_in'] = array_merge( $args['post__not_in'], $sticky_posts );

   243 			}

   244 		}

   245 

   246 		// Force the post_type argument, since it's not a user input variable.

   247 		$args['post_type'] = $this->post_type;

   248 

   249 		/**

   250 		 * Filters the query arguments for a request.

   251 		 *

   252 		 * Enables adding extra arguments or setting defaults for a post collection request.

   253 		 *

   254 		 * @since 4.7.0

   255 		 *

   256 		 * @link https://developer.wordpress.org/reference/classes/wp_query/

   257 		 *

   258 		 * @param array           $args    Key value array of query var to query value.

   259 		 * @param WP_REST_Request $request The request used.

   260 		 */

   261 		$args = apply_filters( "rest_{$this->post_type}_query", $args, $request );

   262 		$query_args = $this->prepare_items_query( $args, $request );

   263 

   264 		$taxonomies = wp_list_filter( get_object_taxonomies( $this->post_type, 'objects' ), array( 'show_in_rest' => true ) );

   265 

   266 		foreach ( $taxonomies as $taxonomy ) {

   267 			$base = ! empty( $taxonomy->rest_base ) ? $taxonomy->rest_base : $taxonomy->name;

   268 			$tax_exclude = $base . '_exclude';

   269 

   270 			if ( ! empty( $request[ $base ] ) ) {

   271 				$query_args['tax_query'][] = array(

   272 					'taxonomy'         => $taxonomy->name,

   273 					'field'            => 'term_id',

   274 					'terms'            => $request[ $base ],

   275 					'include_children' => false,

   276 				);

   277 			}

   278 

   279 			if ( ! empty( $request[ $tax_exclude ] ) ) {

   280 				$query_args['tax_query'][] = array(

   281 					'taxonomy'         => $taxonomy->name,

   282 					'field'            => 'term_id',

   283 					'terms'            => $request[ $tax_exclude ],

   284 					'include_children' => false,

   285 					'operator'         => 'NOT IN',

   286 				);

   287 			}

   288 		}

   289 

   290 		$posts_query  = new WP_Query();

   291 		$query_result = $posts_query->query( $query_args );

   292 

   293 		// Allow access to all password protected posts if the context is edit.

   294 		if ( 'edit' === $request['context'] ) {

   295 			add_filter( 'post_password_required', '__return_false' );

   296 		}

   297 

   298 		$posts = array();

   299 

   300 		foreach ( $query_result as $post ) {

   301 			if ( ! $this->check_read_permission( $post ) ) {

   302 				continue;

   303 			}

   304 

   305 			$data    = $this->prepare_item_for_response( $post, $request );

   306 			$posts[] = $this->prepare_response_for_collection( $data );

   307 		}

   308 

   309 		// Reset filter.

   310 		if ( 'edit' === $request['context'] ) {

   311 			remove_filter( 'post_password_required', '__return_false' );

   312 		}

   313 

   314 		$page = (int) $query_args['paged'];

   315 		$total_posts = $posts_query->found_posts;

   316 

   317 		if ( $total_posts < 1 ) {

   318 			// Out-of-bounds, run the query again without LIMIT for total count.

   319 			unset( $query_args['paged'] );

   320 

   321 			$count_query = new WP_Query();

   322 			$count_query->query( $query_args );

   323 			$total_posts = $count_query->found_posts;

   324 		}

   325 

   326 		$max_pages = ceil( $total_posts / (int) $posts_query->query_vars['posts_per_page'] );

   327 

   328 		if ( $page > $max_pages && $total_posts > 0 ) {

   329 			return new WP_Error( 'rest_post_invalid_page_number', __( 'The page number requested is larger than the number of pages available.' ), array( 'status' => 400 ) );

   330 		}

   331 

   332 		$response  = rest_ensure_response( $posts );

   333 

   334 		$response->header( 'X-WP-Total', (int) $total_posts );

   335 		$response->header( 'X-WP-TotalPages', (int) $max_pages );

   336 

   337 		$request_params = $request->get_query_params();

   338 		$base = add_query_arg( $request_params, rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) );

   339 

   340 		if ( $page > 1 ) {

   341 			$prev_page = $page - 1;

   342 

   343 			if ( $prev_page > $max_pages ) {

   344 				$prev_page = $max_pages;

   345 			}

   346 

   347 			$prev_link = add_query_arg( 'page', $prev_page, $base );

   348 			$response->link_header( 'prev', $prev_link );

   349 		}

   350 		if ( $max_pages > $page ) {

   351 			$next_page = $page + 1;

   352 			$next_link = add_query_arg( 'page', $next_page, $base );

   353 

   354 			$response->link_header( 'next', $next_link );

   355 		}

   356 

   357 		return $response;

   358 	}

   359 

   360 	/**

   361 	 * Get the post, if the ID is valid.

   362 	 *

   363 	 * @since 4.7.2

   364 	 *

   365 	 * @param int $id Supplied ID.

   366 	 * @return WP_Post|WP_Error Post object if ID is valid, WP_Error otherwise.

   367 	 */

   368 	protected function get_post( $id ) {

   369 		$error = new WP_Error( 'rest_post_invalid_id', __( 'Invalid post ID.' ), array( 'status' => 404 ) );

   370 		if ( (int) $id <= 0 ) {

   371 			return $error;

   372 		}

   373 

   374 		$post = get_post( (int) $id );

   375 		if ( empty( $post ) || empty( $post->ID ) || $this->post_type !== $post->post_type ) {

   376 			return $error;

   377 		}

   378 

   379 		return $post;

   380 	}

   381 

   382 	/**

   383 	 * Checks if a given request has access to read a post.

   384 	 *

   385 	 * @since 4.7.0

   386 	 *

   387 	 * @param WP_REST_Request $request Full details about the request.

   388 	 * @return bool|WP_Error True if the request has read access for the item, WP_Error object otherwise.

   389 	 */

   390 	public function get_item_permissions_check( $request ) {

   391 		$post = $this->get_post( $request['id'] );

   392 		if ( is_wp_error( $post ) ) {

   393 			return $post;

   394 		}

   395 

   396 		if ( 'edit' === $request['context'] && $post && ! $this->check_update_permission( $post ) ) {

   397 			return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit this post.' ), array( 'status' => rest_authorization_required_code() ) );

   398 		}

   399 

   400 		if ( $post && ! empty( $request['password'] ) ) {

   401 			// Check post password, and return error if invalid.

   402 			if ( ! hash_equals( $post->post_password, $request['password'] ) ) {

   403 				return new WP_Error( 'rest_post_incorrect_password', __( 'Incorrect post password.' ), array( 'status' => 403 ) );

   404 			}

   405 		}

   406 

   407 		// Allow access to all password protected posts if the context is edit.

   408 		if ( 'edit' === $request['context'] ) {

   409 			add_filter( 'post_password_required', '__return_false' );

   410 		}

   411 

   412 		if ( $post ) {

   413 			return $this->check_read_permission( $post );

   414 		}

   415 

   416 		return true;

   417 	}

   418 

   419 	/**

   420 	 * Checks if the user can access password-protected content.

   421 	 *

   422 	 * This method determines whether we need to override the regular password

   423 	 * check in core with a filter.

   424 	 *

   425 	 * @since 4.7.0

   426 	 *

   427 	 * @param WP_Post         $post    Post to check against.

   428 	 * @param WP_REST_Request $request Request data to check.

   429 	 * @return bool True if the user can access password-protected content, otherwise false.

   430 	 */

   431 	public function can_access_password_content( $post, $request ) {

   432 		if ( empty( $post->post_password ) ) {

   433 			// No filter required.

   434 			return false;

   435 		}

   436 

   437 		// Edit context always gets access to password-protected posts.

   438 		if ( 'edit' === $request['context'] ) {

   439 			return true;

   440 		}

   441 

   442 		// No password, no auth.

   443 		if ( empty( $request['password'] ) ) {

   444 			return false;

   445 		}

   446 

   447 		// Double-check the request password.

   448 		return hash_equals( $post->post_password, $request['password'] );

   449 	}

   450 

   451 	/**

   452 	 * Retrieves a single post.

   453 	 *

   454 	 * @since 4.7.0

   455 	 *

   456 	 * @param WP_REST_Request $request Full details about the request.

   457 	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

   458 	 */

   459 	public function get_item( $request ) {

   460 		$post = $this->get_post( $request['id'] );

   461 		if ( is_wp_error( $post ) ) {

   462 			return $post;

   463 		}

   464 

   465 		$data     = $this->prepare_item_for_response( $post, $request );

   466 		$response = rest_ensure_response( $data );

   467 

   468 		if ( is_post_type_viewable( get_post_type_object( $post->post_type ) ) ) {

   469 			$response->link_header( 'alternate',  get_permalink( $post->ID ), array( 'type' => 'text/html' ) );

   470 		}

   471 

   472 		return $response;

   473 	}

   474 

   475 	/**

   476 	 * Checks if a given request has access to create a post.

   477 	 *

   478 	 * @since 4.7.0

   479 	 *

   480 	 * @param WP_REST_Request $request Full details about the request.

   481 	 * @return true|WP_Error True if the request has access to create items, WP_Error object otherwise.

   482 	 */

   483 	public function create_item_permissions_check( $request ) {

   484 		if ( ! empty( $request['id'] ) ) {

   485 			return new WP_Error( 'rest_post_exists', __( 'Cannot create existing post.' ), array( 'status' => 400 ) );

   486 		}

   487 

   488 		$post_type = get_post_type_object( $this->post_type );

   489 

   490 		if ( ! empty( $request['author'] ) && get_current_user_id() !== $request['author'] && ! current_user_can( $post_type->cap->edit_others_posts ) ) {

   491 			return new WP_Error( 'rest_cannot_edit_others', __( 'Sorry, you are not allowed to create posts as this user.' ), array( 'status' => rest_authorization_required_code() ) );

   492 		}

   493 

   494 		if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) ) {

   495 			return new WP_Error( 'rest_cannot_assign_sticky', __( 'Sorry, you are not allowed to make posts sticky.' ), array( 'status' => rest_authorization_required_code() ) );

   496 		}

   497 

   498 		if ( ! current_user_can( $post_type->cap->create_posts ) ) {

   499 			return new WP_Error( 'rest_cannot_create', __( 'Sorry, you are not allowed to create posts as this user.' ), array( 'status' => rest_authorization_required_code() ) );

   500 		}

   501 

   502 		if ( ! $this->check_assign_terms_permission( $request ) ) {

   503 			return new WP_Error( 'rest_cannot_assign_term', __( 'Sorry, you are not allowed to assign the provided terms.' ), array( 'status' => rest_authorization_required_code() ) );

   504 		}

   505 

   506 		return true;

   507 	}

   508 

   509 	/**

   510 	 * Creates a single post.

   511 	 *

   512 	 * @since 4.7.0

   513 	 *

   514 	 * @param WP_REST_Request $request Full details about the request.

   515 	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

   516 	 */

   517 	public function create_item( $request ) {

   518 		if ( ! empty( $request['id'] ) ) {

   519 			return new WP_Error( 'rest_post_exists', __( 'Cannot create existing post.' ), array( 'status' => 400 ) );

   520 		}

   521 

   522 		$prepared_post = $this->prepare_item_for_database( $request );

   523 

   524 		if ( is_wp_error( $prepared_post ) ) {

   525 			return $prepared_post;

   526 		}

   527 

   528 		$prepared_post->post_type = $this->post_type;

   529 

   530 		$post_id = wp_insert_post( wp_slash( (array) $prepared_post ), true );

   531 

   532 		if ( is_wp_error( $post_id ) ) {

   533 

   534 			if ( 'db_insert_error' === $post_id->get_error_code() ) {

   535 				$post_id->add_data( array( 'status' => 500 ) );

   536 			} else {

   537 				$post_id->add_data( array( 'status' => 400 ) );

   538 			}

   539 

   540 			return $post_id;

   541 		}

   542 

   543 		$post = get_post( $post_id );

   544 

   545 		/**

   546 		 * Fires after a single post is created or updated via the REST API.

   547 		 *

   548 		 * The dynamic portion of the hook name, `$this->post_type`, refers to the post type slug.

   549 		 *

   550 		 * @since 4.7.0

   551 		 *

   552 		 * @param WP_Post         $post     Inserted or updated post object.

   553 		 * @param WP_REST_Request $request  Request object.

   554 		 * @param bool            $creating True when creating a post, false when updating.

   555 		 */

   556 		do_action( "rest_insert_{$this->post_type}", $post, $request, true );

   557 

   558 		$schema = $this->get_item_schema();

   559 

   560 		if ( ! empty( $schema['properties']['sticky'] ) ) {

   561 			if ( ! empty( $request['sticky'] ) ) {

   562 				stick_post( $post_id );

   563 			} else {

   564 				unstick_post( $post_id );

   565 			}

   566 		}

   567 

   568 		if ( ! empty( $schema['properties']['featured_media'] ) && isset( $request['featured_media'] ) ) {

   569 			$this->handle_featured_media( $request['featured_media'], $post_id );

   570 		}

   571 

   572 		if ( ! empty( $schema['properties']['format'] ) && ! empty( $request['format'] ) ) {

   573 			set_post_format( $post, $request['format'] );

   574 		}

   575 

   576 		if ( ! empty( $schema['properties']['template'] ) && isset( $request['template'] ) ) {

   577 			$this->handle_template( $request['template'], $post_id, true );

   578 		}

   579 

   580 		$terms_update = $this->handle_terms( $post_id, $request );

   581 

   582 		if ( is_wp_error( $terms_update ) ) {

   583 			return $terms_update;

   584 		}

   585 

   586 		if ( ! empty( $schema['properties']['meta'] ) && isset( $request['meta'] ) ) {

   587 			$meta_update = $this->meta->update_value( $request['meta'], $post_id );

   588 

   589 			if ( is_wp_error( $meta_update ) ) {

   590 				return $meta_update;

   591 			}

   592 		}

   593 

   594 		$post = get_post( $post_id );

   595 		$fields_update = $this->update_additional_fields_for_object( $post, $request );

   596 

   597 		if ( is_wp_error( $fields_update ) ) {

   598 			return $fields_update;

   599 		}

   600 

   601 		$request->set_param( 'context', 'edit' );

   602 

   603 		$response = $this->prepare_item_for_response( $post, $request );

   604 		$response = rest_ensure_response( $response );

   605 

   606 		$response->set_status( 201 );

   607 		$response->header( 'Location', rest_url( sprintf( '%s/%s/%d', $this->namespace, $this->rest_base, $post_id ) ) );

   608 

   609 		return $response;

   610 	}

   611 

   612 	/**

   613 	 * Checks if a given request has access to update a post.

   614 	 *

   615 	 * @since 4.7.0

   616 	 *

   617 	 * @param WP_REST_Request $request Full details about the request.

   618 	 * @return true|WP_Error True if the request has access to update the item, WP_Error object otherwise.

   619 	 */

   620 	public function update_item_permissions_check( $request ) {

   621 		$post = $this->get_post( $request['id'] );

   622 		if ( is_wp_error( $post ) ) {

   623 			return $post;

   624 		}

   625 

   626 		$post_type = get_post_type_object( $this->post_type );

   627 

   628 		if ( $post && ! $this->check_update_permission( $post ) ) {

   629 			return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit this post.' ), array( 'status' => rest_authorization_required_code() ) );

   630 		}

   631 

   632 		if ( ! empty( $request['author'] ) && get_current_user_id() !== $request['author'] && ! current_user_can( $post_type->cap->edit_others_posts ) ) {

   633 			return new WP_Error( 'rest_cannot_edit_others', __( 'Sorry, you are not allowed to update posts as this user.' ), array( 'status' => rest_authorization_required_code() ) );

   634 		}

   635 

   636 		if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) ) {

   637 			return new WP_Error( 'rest_cannot_assign_sticky', __( 'Sorry, you are not allowed to make posts sticky.' ), array( 'status' => rest_authorization_required_code() ) );

   638 		}

   639 

   640 		if ( ! $this->check_assign_terms_permission( $request ) ) {

   641 			return new WP_Error( 'rest_cannot_assign_term', __( 'Sorry, you are not allowed to assign the provided terms.' ), array( 'status' => rest_authorization_required_code() ) );

   642 		}

   643 

   644 		return true;

   645 	}

   646 

   647 	/**

   648 	 * Updates a single post.

   649 	 *

   650 	 * @since 4.7.0

   651 	 *

   652 	 * @param WP_REST_Request $request Full details about the request.

   653 	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

   654 	 */

   655 	public function update_item( $request ) {

   656 		$valid_check = $this->get_post( $request['id'] );

   657 		if ( is_wp_error( $valid_check ) ) {

   658 			return $valid_check;

   659 		}

   660 

   661 		$post = $this->prepare_item_for_database( $request );

   662 

   663 		if ( is_wp_error( $post ) ) {

   664 			return $post;

   665 		}

   666 

   667 		// convert the post object to an array, otherwise wp_update_post will expect non-escaped input.

   668 		$post_id = wp_update_post( wp_slash( (array) $post ), true );

   669 

   670 		if ( is_wp_error( $post_id ) ) {

   671 			if ( 'db_update_error' === $post_id->get_error_code() ) {

   672 				$post_id->add_data( array( 'status' => 500 ) );

   673 			} else {

   674 				$post_id->add_data( array( 'status' => 400 ) );

   675 			}

   676 			return $post_id;

   677 		}

   678 

   679 		$post = get_post( $post_id );

   680 

   681 		/** This action is documented in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php */

   682 		do_action( "rest_insert_{$this->post_type}", $post, $request, false );

   683 

   684 		$schema = $this->get_item_schema();

   685 

   686 		if ( ! empty( $schema['properties']['format'] ) && ! empty( $request['format'] ) ) {

   687 			set_post_format( $post, $request['format'] );

   688 		}

   689 

   690 		if ( ! empty( $schema['properties']['featured_media'] ) && isset( $request['featured_media'] ) ) {

   691 			$this->handle_featured_media( $request['featured_media'], $post_id );

   692 		}

   693 

   694 		if ( ! empty( $schema['properties']['sticky'] ) && isset( $request['sticky'] ) ) {

   695 			if ( ! empty( $request['sticky'] ) ) {

   696 				stick_post( $post_id );

   697 			} else {

   698 				unstick_post( $post_id );

   699 			}

   700 		}

   701 

   702 		if ( ! empty( $schema['properties']['template'] ) && isset( $request['template'] ) ) {

   703 			$this->handle_template( $request['template'], $post->ID );

   704 		}

   705 

   706 		$terms_update = $this->handle_terms( $post->ID, $request );

   707 

   708 		if ( is_wp_error( $terms_update ) ) {

   709 			return $terms_update;

   710 		}

   711 

   712 		if ( ! empty( $schema['properties']['meta'] ) && isset( $request['meta'] ) ) {

   713 			$meta_update = $this->meta->update_value( $request['meta'], $post->ID );

   714 

   715 			if ( is_wp_error( $meta_update ) ) {

   716 				return $meta_update;

   717 			}

   718 		}

   719 

   720 		$post = get_post( $post_id );

   721 		$fields_update = $this->update_additional_fields_for_object( $post, $request );

   722 

   723 		if ( is_wp_error( $fields_update ) ) {

   724 			return $fields_update;

   725 		}

   726 

   727 		$request->set_param( 'context', 'edit' );

   728 

   729 		$response = $this->prepare_item_for_response( $post, $request );

   730 

   731 		return rest_ensure_response( $response );

   732 	}

   733 

   734 	/**

   735 	 * Checks if a given request has access to delete a post.

   736 	 *

   737 	 * @since 4.7.0

   738 	 *

   739 	 * @param WP_REST_Request $request Full details about the request.

   740 	 * @return true|WP_Error True if the request has access to delete the item, WP_Error object otherwise.

   741 	 */

   742 	public function delete_item_permissions_check( $request ) {

   743 		$post = $this->get_post( $request['id'] );

   744 		if ( is_wp_error( $post ) ) {

   745 			return $post;

   746 		}

   747 

   748 		if ( $post && ! $this->check_delete_permission( $post ) ) {

   749 			return new WP_Error( 'rest_cannot_delete', __( 'Sorry, you are not allowed to delete this post.' ), array( 'status' => rest_authorization_required_code() ) );

   750 		}

   751 

   752 		return true;

   753 	}

   754 

   755 	/**

   756 	 * Deletes a single post.

   757 	 *

   758 	 * @since 4.7.0

   759 	 *

   760 	 * @param WP_REST_Request $request Full details about the request.

   761 	 * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.

   762 	 */

   763 	public function delete_item( $request ) {

   764 		$post = $this->get_post( $request['id'] );

   765 		if ( is_wp_error( $post ) ) {

   766 			return $post;

   767 		}

   768 

   769 		$id    = $post->ID;

   770 		$force = (bool) $request['force'];

   771 

   772 		$supports_trash = ( EMPTY_TRASH_DAYS > 0 );

   773 

   774 		if ( 'attachment' === $post->post_type ) {

   775 			$supports_trash = $supports_trash && MEDIA_TRASH;

   776 		}

   777 

   778 		/**

   779 		 * Filters whether a post is trashable.

   780 		 *

   781 		 * The dynamic portion of the hook name, `$this->post_type`, refers to the post type slug.

   782 		 *

   783 		 * Pass false to disable trash support for the post.

   784 		 *

   785 		 * @since 4.7.0

   786 		 *

   787 		 * @param bool    $supports_trash Whether the post type support trashing.

   788 		 * @param WP_Post $post           The Post object being considered for trashing support.

   789 		 */

   790 		$supports_trash = apply_filters( "rest_{$this->post_type}_trashable", $supports_trash, $post );

   791 

   792 		if ( ! $this->check_delete_permission( $post ) ) {

   793 			return new WP_Error( 'rest_user_cannot_delete_post', __( 'Sorry, you are not allowed to delete this post.' ), array( 'status' => rest_authorization_required_code() ) );

   794 		}

   795 

   796 		$request->set_param( 'context', 'edit' );

   797 

   798 

   799 		// If we're forcing, then delete permanently.

   800 		if ( $force ) {

   801 			$previous = $this->prepare_item_for_response( $post, $request );

   802 			$result = wp_delete_post( $id, true );

   803 			$response = new WP_REST_Response();

   804 			$response->set_data( array( 'deleted' => true, 'previous' => $previous->get_data() ) );

   805 		} else {

   806 			// If we don't support trashing for this type, error out.

   807 			if ( ! $supports_trash ) {

   808 				/* translators: %s: force=true */

   809 				return new WP_Error( 'rest_trash_not_supported', sprintf( __( "The post does not support trashing. Set '%s' to delete." ), 'force=true' ), array( 'status' => 501 ) );

   810 			}

   811 

   812 			// Otherwise, only trash if we haven't already.

   813 			if ( 'trash' === $post->post_status ) {

   814 				return new WP_Error( 'rest_already_trashed', __( 'The post has already been deleted.' ), array( 'status' => 410 ) );

   815 			}

   816 

   817 			// (Note that internally this falls through to `wp_delete_post` if

   818 			// the trash is disabled.)

   819 			$result = wp_trash_post( $id );

   820 			$post = get_post( $id );

   821 			$response = $this->prepare_item_for_response( $post, $request );

   822 		}

   823 

   824 		if ( ! $result ) {

   825 			return new WP_Error( 'rest_cannot_delete', __( 'The post cannot be deleted.' ), array( 'status' => 500 ) );

   826 		}

   827 

   828 		/**

   829 		 * Fires immediately after a single post is deleted or trashed via the REST API.

   830 		 *

   831 		 * They dynamic portion of the hook name, `$this->post_type`, refers to the post type slug.

   832 		 *

   833 		 * @since 4.7.0

   834 		 *

   835 		 * @param object           $post     The deleted or trashed post.

   836 		 * @param WP_REST_Response $response The response data.

   837 		 * @param WP_REST_Request  $request  The request sent to the API.

   838 		 */

   839 		do_action( "rest_delete_{$this->post_type}", $post, $response, $request );

   840 

   841 		return $response;

   842 	}

   843 

   844 	/**

   845 	 * Determines the allowed query_vars for a get_items() response and prepares

   846 	 * them for WP_Query.

   847 	 *

   848 	 * @since 4.7.0

   849 	 *

   850 	 * @param array           $prepared_args Optional. Prepared WP_Query arguments. Default empty array.

   851 	 * @param WP_REST_Request $request       Optional. Full details about the request.

   852 	 * @return array Items query arguments.

   853 	 */

   854 	protected function prepare_items_query( $prepared_args = array(), $request = null ) {

   855 		$query_args = array();

   856 

   857 		foreach ( $prepared_args as $key => $value ) {

   858 			/**

   859 			 * Filters the query_vars used in get_items() for the constructed query.

   860 			 *

   861 			 * The dynamic portion of the hook name, `$key`, refers to the query_var key.

   862 			 *

   863 			 * @since 4.7.0

   864 			 *

   865 			 * @param string $value The query_var value.

   866 			 */

   867 			$query_args[ $key ] = apply_filters( "rest_query_var-{$key}", $value );

   868 		}

   869 

   870 		if ( 'post' !== $this->post_type || ! isset( $query_args['ignore_sticky_posts'] ) ) {

   871 			$query_args['ignore_sticky_posts'] = true;

   872 		}

   873 

   874 		// Map to proper WP_Query orderby param.

   875 		if ( isset( $query_args['orderby'] ) && isset( $request['orderby'] ) ) {

   876 			$orderby_mappings = array(

   877 				'id'            => 'ID',

   878 				'include'       => 'post__in',

   879 				'slug'          => 'post_name',

   880 				'include_slugs' => 'post_name__in',

   881 			);

   882 

   883 			if ( isset( $orderby_mappings[ $request['orderby'] ] ) ) {

   884 				$query_args['orderby'] = $orderby_mappings[ $request['orderby'] ];

   885 			}

   886 		}

   887 

   888 		return $query_args;

   889 	}

   890 

   891 	/**

   892 	 * Checks the post_date_gmt or modified_gmt and prepare any post or

   893 	 * modified date for single post output.

   894 	 *

   895 	 * @since 4.7.0

   896 	 *

   897 	 * @param string      $date_gmt GMT publication time.

   898 	 * @param string|null $date     Optional. Local publication time. Default null.

   899 	 * @return string|null ISO8601/RFC3339 formatted datetime.

   900 	 */

   901 	protected function prepare_date_response( $date_gmt, $date = null ) {

   902 		// Use the date if passed.

   903 		if ( isset( $date ) ) {

   904 			return mysql_to_rfc3339( $date );

   905 		}

   906 

   907 		// Return null if $date_gmt is empty/zeros.

   908 		if ( '0000-00-00 00:00:00' === $date_gmt ) {

   909 			return null;

   910 		}

   911 

   912 		// Return the formatted datetime.

   913 		return mysql_to_rfc3339( $date_gmt );

   914 	}

   915 

   916 	/**

   917 	 * Prepares a single post for create or update.

   918 	 *

   919 	 * @since 4.7.0

   920 	 *

   921 	 * @param WP_REST_Request $request Request object.

   922 	 * @return stdClass|WP_Error Post object or WP_Error.

   923 	 */

   924 	protected function prepare_item_for_database( $request ) {

   925 		$prepared_post = new stdClass;

   926 

   927 		// Post ID.

   928 		if ( isset( $request['id'] ) ) {

   929 			$existing_post = $this->get_post( $request['id'] );

   930 			if ( is_wp_error( $existing_post ) ) {

   931 				return $existing_post;

   932 			}

   933 

   934 			$prepared_post->ID = $existing_post->ID;

   935 		}

   936 

   937 		$schema = $this->get_item_schema();

   938 

   939 		// Post title.

   940 		if ( ! empty( $schema['properties']['title'] ) && isset( $request['title'] ) ) {

   941 			if ( is_string( $request['title'] ) ) {

   942 				$prepared_post->post_title = $request['title'];

   943 			} elseif ( ! empty( $request['title']['raw'] ) ) {

   944 				$prepared_post->post_title = $request['title']['raw'];

   945 			}

   946 		}

   947 

   948 		// Post content.

   949 		if ( ! empty( $schema['properties']['content'] ) && isset( $request['content'] ) ) {

   950 			if ( is_string( $request['content'] ) ) {

   951 				$prepared_post->post_content = $request['content'];

   952 			} elseif ( isset( $request['content']['raw'] ) ) {

   953 				$prepared_post->post_content = $request['content']['raw'];

   954 			}

   955 		}

   956 

   957 		// Post excerpt.

   958 		if ( ! empty( $schema['properties']['excerpt'] ) && isset( $request['excerpt'] ) ) {

   959 			if ( is_string( $request['excerpt'] ) ) {

   960 				$prepared_post->post_excerpt = $request['excerpt'];

   961 			} elseif ( isset( $request['excerpt']['raw'] ) ) {

   962 				$prepared_post->post_excerpt = $request['excerpt']['raw'];

   963 			}

   964 		}

   965 

   966 		// Post type.

   967 		if ( empty( $request['id'] ) ) {

   968 			// Creating new post, use default type for the controller.

   969 			$prepared_post->post_type = $this->post_type;

   970 		} else {

   971 			// Updating a post, use previous type.

   972 			$prepared_post->post_type = get_post_type( $request['id'] );

   973 		}

   974 

   975 		$post_type = get_post_type_object( $prepared_post->post_type );

   976 

   977 		// Post status.

   978 		if ( ! empty( $schema['properties']['status'] ) && isset( $request['status'] ) ) {

   979 			$status = $this->handle_status_param( $request['status'], $post_type );

   980 

   981 			if ( is_wp_error( $status ) ) {

   982 				return $status;

   983 			}

   984 

   985 			$prepared_post->post_status = $status;

   986 		}

   987 

   988 		// Post date.

   989 		if ( ! empty( $schema['properties']['date'] ) && ! empty( $request['date'] ) ) {

   990 			$date_data = rest_get_date_with_gmt( $request['date'] );

   991 

   992 			if ( ! empty( $date_data ) ) {

   993 				list( $prepared_post->post_date, $prepared_post->post_date_gmt ) = $date_data;

   994 				$prepared_post->edit_date = true;

   995 			}

   996 		} elseif ( ! empty( $schema['properties']['date_gmt'] ) && ! empty( $request['date_gmt'] ) ) {

   997 			$date_data = rest_get_date_with_gmt( $request['date_gmt'], true );

   998 

   999 			if ( ! empty( $date_data ) ) {

  1000 				list( $prepared_post->post_date, $prepared_post->post_date_gmt ) = $date_data;

  1001 				$prepared_post->edit_date = true;

  1002 			}

  1003 		}

  1004 

  1005 		// Post slug.

  1006 		if ( ! empty( $schema['properties']['slug'] ) && isset( $request['slug'] ) ) {

  1007 			$prepared_post->post_name = $request['slug'];

  1008 		}

  1009 

  1010 		// Author.

  1011 		if ( ! empty( $schema['properties']['author'] ) && ! empty( $request['author'] ) ) {

  1012 			$post_author = (int) $request['author'];

  1013 

  1014 			if ( get_current_user_id() !== $post_author ) {

  1015 				$user_obj = get_userdata( $post_author );

  1016 

  1017 				if ( ! $user_obj ) {

  1018 					return new WP_Error( 'rest_invalid_author', __( 'Invalid author ID.' ), array( 'status' => 400 ) );

  1019 				}

  1020 			}

  1021 

  1022 			$prepared_post->post_author = $post_author;

  1023 		}

  1024 

  1025 		// Post password.

  1026 		if ( ! empty( $schema['properties']['password'] ) && isset( $request['password'] ) ) {

  1027 			$prepared_post->post_password = $request['password'];

  1028 

  1029 			if ( '' !== $request['password'] ) {

  1030 				if ( ! empty( $schema['properties']['sticky'] ) && ! empty( $request['sticky'] ) ) {

  1031 					return new WP_Error( 'rest_invalid_field', __( 'A post can not be sticky and have a password.' ), array( 'status' => 400 ) );

  1032 				}

  1033 

  1034 				if ( ! empty( $prepared_post->ID ) && is_sticky( $prepared_post->ID ) ) {

  1035 					return new WP_Error( 'rest_invalid_field', __( 'A sticky post can not be password protected.' ), array( 'status' => 400 ) );

  1036 				}

  1037 			}

  1038 		}

  1039 

  1040 		if ( ! empty( $schema['properties']['sticky'] ) && ! empty( $request['sticky'] ) ) {

  1041 			if ( ! empty( $prepared_post->ID ) && post_password_required( $prepared_post->ID ) ) {

  1042 				return new WP_Error( 'rest_invalid_field', __( 'A password protected post can not be set to sticky.' ), array( 'status' => 400 ) );

  1043 			}

  1044 		}

  1045 

  1046 		// Parent.

  1047 		if ( ! empty( $schema['properties']['parent'] ) && isset( $request['parent'] ) ) {

  1048 			if ( 0 === (int) $request['parent'] ) {

  1049 				$prepared_post->post_parent = 0;

  1050 			} else {

  1051 				$parent = get_post( (int) $request['parent'] );

  1052 				if ( empty( $parent ) ) {

  1053 					return new WP_Error( 'rest_post_invalid_id', __( 'Invalid post parent ID.' ), array( 'status' => 400 ) );

  1054 				}

  1055 				$prepared_post->post_parent = (int) $parent->ID;

  1056 			}

  1057 		}

  1058 

  1059 		// Menu order.

  1060 		if ( ! empty( $schema['properties']['menu_order'] ) && isset( $request['menu_order'] ) ) {

  1061 			$prepared_post->menu_order = (int) $request['menu_order'];

  1062 		}

  1063 

  1064 		// Comment status.

  1065 		if ( ! empty( $schema['properties']['comment_status'] ) && ! empty( $request['comment_status'] ) ) {

  1066 			$prepared_post->comment_status = $request['comment_status'];

  1067 		}

  1068 

  1069 		// Ping status.

  1070 		if ( ! empty( $schema['properties']['ping_status'] ) && ! empty( $request['ping_status'] ) ) {

  1071 			$prepared_post->ping_status = $request['ping_status'];

  1072 		}

  1073 

  1074 		if ( ! empty( $schema['properties']['template'] ) ) {

  1075 			// Force template to null so that it can be handled exclusively by the REST controller.

  1076 			$prepared_post->page_template = null;

  1077 		}

  1078 

  1079 		/**

  1080 		 * Filters a post before it is inserted via the REST API.

  1081 		 *

  1082 		 * The dynamic portion of the hook name, `$this->post_type`, refers to the post type slug.

  1083 		 *

  1084 		 * @since 4.7.0

  1085 		 *

  1086 		 * @param stdClass        $prepared_post An object representing a single post prepared

  1087 		 *                                       for inserting or updating the database.

  1088 		 * @param WP_REST_Request $request       Request object.

  1089 		 */

  1090 		return apply_filters( "rest_pre_insert_{$this->post_type}", $prepared_post, $request );

  1091 

  1092 	}

  1093 

  1094 	/**

  1095 	 * Determines validity and normalizes the given status parameter.

  1096 	 *

  1097 	 * @since 4.7.0

  1098 	 *

  1099 	 * @param string $post_status Post status.

  1100 	 * @param object $post_type   Post type.

  1101 	 * @return string|WP_Error Post status or WP_Error if lacking the proper permission.

  1102 	 */

  1103 	protected function handle_status_param( $post_status, $post_type ) {

  1104 

  1105 		switch ( $post_status ) {

  1106 			case 'draft':

  1107 			case 'pending':

  1108 				break;

  1109 			case 'private':

  1110 				if ( ! current_user_can( $post_type->cap->publish_posts ) ) {

  1111 					return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create private posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );

  1112 				}

  1113 				break;

  1114 			case 'publish':

  1115 			case 'future':

  1116 				if ( ! current_user_can( $post_type->cap->publish_posts ) ) {

  1117 					return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to publish posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );

  1118 				}

  1119 				break;

  1120 			default:

  1121 				if ( ! get_post_status_object( $post_status ) ) {

  1122 					$post_status = 'draft';

  1123 				}

  1124 				break;

  1125 		}

  1126 

  1127 		return $post_status;

  1128 	}

  1129 

  1130 	/**

  1131 	 * Determines the featured media based on a request param.

  1132 	 *

  1133 	 * @since 4.7.0

  1134 	 *

  1135 	 * @param int $featured_media Featured Media ID.