Merge pull request #1154 from publishpress/release-4.0.29

Release 4.0.29
publishpress · Sep 16, 2024 · 0b8dc64 · 0b8dc64
2 parents f89a687 + 1bba1a9
commit 0b8dc64
Show file tree

Hide file tree

Showing 35 changed files with 439 additions and 235 deletions.
diff --git a/classes/PressShack/LibWP.php b/classes/PressShack/LibWP.php
@@ -215,11 +215,11 @@ private static function disableGutenberg($post_id = false) {
 
         if (function_exists('disable_gutenberg_whitelist_title') && disable_gutenberg_whitelist_title($post_id)) return false;
 
-        if (isset($_GET['block-editor'])) return false;
+        if (self::is_GET('block-editor')) return false;
 
-        if (isset($_GET['classic-editor'])) return true;
+        if (self::is_GET('classic-editor')) return true;
 
-        if (isset($_POST['classic-editor'])) return true;
+        if (self::is_POST('classic-editor')) return true;
 
         if (function_exists('disable_gutenberg_disable_all') && disable_gutenberg_disable_all()) return true;
 

diff --git a/classes/PublishPress/Permissions.php b/classes/PublishPress/Permissions.php
@@ -828,8 +828,7 @@ public function fltPluginCompatUnfilteredContent($unfiltered) {
     public function isUserUnfiltered($user_id = false, $args = [])
     {
         // todo: any other Gutenberg Administrator requests to filter?
-        $is_unfiltered = $this->isAdministrator($user_id, 'unfiltered', $args) 
-        && (!defined('REST_REQUEST') || ! REST_REQUEST || (PWP::empty_REQUEST('parent_exclude') || did_action('presspermit_refresh_administrator_check'))); // page parent dropdown
+        $is_unfiltered = $this->isAdministrator($user_id, 'unfiltered', $args);
 
         $args['user_id'] = $user_id;
 
@@ -903,6 +902,10 @@ public function getEnabledPostTypes($args = [], $output = 'names')
 
         $types = get_post_types(array_merge($args, ['public' => true, 'show_ui' => true]), 'names', 'or');
 
+        $supported_private_types = apply_filters('presspermit_supported_private_types', ['series_grouping']);
+
+        $types = array_merge($types, array_fill_keys($supported_private_types, true));
+
         $omit_types = apply_filters('presspermit_unfiltered_post_types', ['wp_block']); // todo: review wp_block filtering
 
         $object_types = array_diff_key($types, array_fill_keys($omit_types, true));
@@ -957,7 +960,9 @@ public function getEnabledTaxonomies($args = [], $output = 'names')
             $object_types = ($object_type) ? (array)$object_type : $this->getEnabledPostTypes();
 
             foreach (get_taxonomies($args, 'object') as $tx) {
-                if (array_intersect($object_types, $tx->object_type)) {
+                if (array_intersect($object_types, $tx->object_type)
+                || in_array($tx->name, apply_filters('presspermit_universal_taxonomies', ['series_group']))
+                ) {
                     $taxonomies[] = $tx->name;
                 }
             }

diff --git a/classes/PublishPress/Permissions/Admin.php b/classes/PublishPress/Permissions/Admin.php
@@ -281,7 +281,7 @@ function publishpressFooter() {
         </a></li>
         </ul>
         </nav>
-        
+
         <div class="pp-pressshack-logo">
         <a href="//publishpress.com" target="_blank" rel="noopener noreferrer">
         <img src="<?php echo esc_url(plugins_url('', PRESSPERMIT_FILE)) . '/common/img/publishpress-logo.png';?>" />

diff --git a/classes/PublishPress/Permissions/DB/DatabaseSetup.php b/classes/PublishPress/Permissions/DB/DatabaseSetup.php
@@ -6,10 +6,10 @@ class DatabaseSetup
 {
     function __construct($last_db_ver = false)
     {
-        self::updateSchema();
+        self::updateSchema($last_db_ver);
     }
 
-    private static function updateSchema()
+    private static function updateSchema($last_db_ver = false)
     {
         global $wpdb;
 
@@ -39,6 +39,9 @@ private static function updateSchema()
         ;
         ";
 
+        // For existing installations, don't risk existing data violating unique key requirement
+        $unique = ($last_db_ver) ? '' : 'UNIQUE ';
+
         // User2Group table def
         $tabledefs .= "CREATE TABLE $wpdb->pp_group_members (
          group_id bigint(20) unsigned NOT NULL default '0',
@@ -49,7 +52,7 @@ private static function updateSchema()
          date_limited tinyint(2) NOT NULL default '0',
          start_date_gmt datetime NOT NULL default '0000-00-00 00:00:00',
          end_date_gmt datetime NOT NULL default '2035-01-01 00:00:00',
-            KEY pp_group_user (group_id,user_id),
+            {$unique}KEY pp_group_user (group_id,user_id),
             KEY pp_member_status (status,member_type),
             KEY pp_member_date (start_date_gmt,end_date_gmt,date_limited,user_id,group_id) )
             $charset_collate

diff --git a/classes/PublishPress/Permissions/DB/Groups.php b/classes/PublishPress/Permissions/DB/Groups.php
@@ -274,6 +274,7 @@ public static function getGroupsForUser($user, $args = [])
             'force_refresh' => false,
             'query_user_ids' => false,
         ];
+
         $args = array_merge($defaults, $args);
 
         if (isset($args['metagroup_type']) && is_null($args['metagroup_type'])) {
@@ -301,8 +302,6 @@ public static function getGroupsForUser($user, $args = [])
         }
 
         // Build a cache key to disginguish results by user id and args, but don't consider cols, query_user_ids or force_refresh
-
-
         unset($args['query_user_ids']);
         unset($args['cols']);
         unset($args['force_refresh']);
@@ -351,8 +350,6 @@ public static function getGroupsForUser($user, $args = [])
 
                     . " WHERE member_type = %s $status_clause $metagroup_clause AND user_id IN ('$user_id_csv')",  // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
 
-                    //. " ORDER BY $wpdb->members_table.group_id",
-
                     $member_type
                 )
             );

diff --git a/classes/PublishPress/Permissions/DB/Permissions.php b/classes/PublishPress/Permissions/DB/Permissions.php
@@ -117,7 +117,13 @@ public static function getExceptions($args = [])
 
         $operations = (array)$operations;
 
+        $page_parent_editable_only = $pp->getOption('page_parent_editable_only');
+
         if ($operations) {
+            if ($page_parent_editable_only && in_array('associate', $operations)) {
+                $operations = array_merge($operations, ['edit']);
+            }
+
             // avoid application of exceptions which are disabled due to plugin deactivation
             $operations = array_intersect($operations, $pp->getOperations());
         } else {
@@ -284,6 +290,11 @@ public static function getExceptions($args = [])
         foreach ($results as $row) {
             // note: currently only additional access can be status-specific
             $except["{$row->operation}_{$row->for_item_source}"][$row->via_item_source][$row->via_item_type][$row->mod_type][$row->for_item_type][$row->for_item_status][] = $row->item_id;
+
+            // Mirror Edit exceptions for page parent association
+            if ($page_parent_editable_only && ('edit' == $row->operation)) {
+                $except["associate_{$row->for_item_source}"][$row->via_item_source][$row->via_item_type][$row->mod_type][$row->for_item_type][$row->for_item_status][] = $row->item_id;
+            }
         }
 
         return $except;

diff --git a/classes/PublishPress/Permissions/ItemSave.php b/classes/PublishPress/Permissions/ItemSave.php
@@ -166,24 +166,39 @@ public static function inheritParentExceptions($item_id, $args = [])
 
         $is_new_term = ('term' != $via_item_source) ? false : PWP::is_REQUEST('action', 'add-tag');
 
-        // don't execute this action handler more than one per post save (may be called directly on pre-save cap check)
-        static $did_items;
-        if ('post' == $via_item_source) {
-            if (!isset($did_items)) {
-                $did_items = [];
-            }
-            if (isset($did_items[$item_id])) {
-                return;
-            }
-            $did_items[$item_id] = 1;
-        }
-
         if (!apply_filters('presspermit_do_inherit_parent_exceptions', true, $item_id, $args)) {
             return;
         }
 
+        global $wp_version;
+
+        $is_wp_66 = version_compare($wp_version, '6.6', '>=');
+        $is_block_editor = PWP::isBlockEditorActive();
+
+        if (!$is_block_editor || !$is_wp_66) {
+            // legacy condition to avoid disturbing existing installs
+            $inherit_exceptions = (intval($set_parent) != intval($last_parent)) || $is_new_term || $is_new;
+        } else {
+            // new condition to fix 6.6 Block Editor integration (also moved static $did_items check inside inherit_exceptions block)
+            $inherit_exceptions = $set_parent;
+        }
+
         // Inherit exceptions from new parent post/term, but only for new items or if parent is changed
-        if ((intval($set_parent) != intval($last_parent)) || $is_new_term || $is_new) {
+        if ($inherit_exceptions) {
+	        // don't execute this action handler more than one per post save (may be called directly on pre-save cap check)
+	        static $did_items;
+
+	        if ('post' == $via_item_source) {
+	            if (!isset($did_items)) {
+	                $did_items = [];
+	            }
+
+	            if (isset($did_items[$item_id])) {
+	                return;
+	            }
+
+	            $did_items[$item_id] = 1;
+	        }
 
             // retain all explicitly selected exceptions
             global $wpdb;                               // any_type_or_taxonomy arg retains previous query construction (no post_type or taxonomy clause)

diff --git a/classes/PublishPress/Permissions/PageFilters.php b/classes/PublishPress/Permissions/PageFilters.php
@@ -459,7 +459,8 @@ public static function fltGetPages($results, $args = [])
 
             $groupby = $distinct = '';
 
-            if (in_array($pagenow, ['post.php', 'post-new.php']) || (defined('REST_REQUEST') && REST_REQUEST)) {
+            if ((in_array($pagenow, ['post.php', 'post-new.php']) || (defined('REST_REQUEST') && REST_REQUEST))
+            ) {
                 $clauses = apply_filters(
                     'presspermit_get_pages_clauses',
                     compact('distinct', 'fields', 'join', 'where', 'groupby', 'orderby', 'limits'),
@@ -475,12 +476,18 @@ public static function fltGetPages($results, $args = [])
                 else
                     $_args['required_operation'] = (PWP::isFront() && !presspermit_is_preview()) ? 'read' : 'edit';
 
+                if (('associate' == $_args['required_operation']) && presspermit()->getOption('page_parent_editable_only')) {
+                    $_args['required_operation'] = 'edit';
+                }
+
                 $rest_params = (defined('REST_REQUEST') && REST_REQUEST) ? \PublishPress\Permissions\REST::instance()->params : [];
 
                 if (((('edit' == $_args['required_operation']) && (isset($args['post_parent']) || !empty($rest_params['exclude']) || !empty($rest_params['parent_exclude']))))
                 || ('associate' == $alternate_operation)
                 ) {  // workaround for CMS Page View
-                    $_args['alternate_required_ops'] = ['associate'];
+                    if (!presspermit()->getOption('page_parent_editable_only')) {
+                        $_args['alternate_required_ops'] = ['associate'];
+                    }
                 }
 
                 $clauses = apply_filters(

diff --git a/classes/PublishPress/Permissions/PostFilters.php b/classes/PublishPress/Permissions/PostFilters.php
@@ -166,8 +166,17 @@ public function fltPostsClauses($clauses, $_wp_query = false, $args = [])
 			return $clauses;
 		}
 
+        if (defined('REST_REQUEST')) {
+        	if (class_exists('PublishPress\Permissions\REST') && !empty(\PublishPress\Permissions\REST::instance()->params['getpages_filtering'])) {
+        		$rest_getpages_filtering = true;	
+        	}
+        }
+
         // Gallery block in Gutenberg editor: error loading Image Size dropdown options
-        if (defined('REST_REQUEST') && (0 == strpos(PWP::SERVER_url('REQUEST_URI'), "/blocks")) && !PWP::empty_REQUEST('context') && ('edit' == PWP::REQUEST_key('context'))) {
+        if (defined('REST_REQUEST') && empty($rest_getpages_filtering)
+        && empty($_POST) && (!isset($_SERVER['REQUEST_METHOD']) || ('GET' == $_SERVER['REQUEST_METHOD']))  // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing
+        && !PWP::empty_REQUEST('context') && ('edit' == PWP::REQUEST_key('context'))
+        ) {
             return $clauses;
         }
 
@@ -292,12 +301,29 @@ public function fltPostsClauses($clauses, $_wp_query = false, $args = [])
 
         $args['post_types'] = $post_types;
 
-        if (isset($_wp_query->query_vars['required_operation'])) {
+        if (empty($args['required_operation']) && isset($_wp_query->query_vars['required_operation'])) {
             $args['required_operation'] = $_wp_query->query_vars['required_operation'];
         }
 
         $clauses = $this->fltDoPostsClauses($clauses, $args);
 
+        // On one test site, WP 6.6 stripped unpublished pages out of Gutenberg Page Parent selection results.
+        // This only occurred with "Page Parent selection for Editable Pages only" enabled.
+        // It may have been a quirk with the test site, but this workaround is left for activation by constant if needed.
+        if (!empty($rest_getpages_filtering) 
+        && defined('PP_PARENT_SELECTION_STATUS_WORKAROUND')
+        ) {
+            add_filter('posts_results', function($results) {
+                foreach ($results as $k => $row) {
+                    if (!in_array($results[$k]->post_status, ['publish'])) {
+                        $results[$k]->post_status = 'publish';
+                    }
+                }
+
+                return $results;
+            }, 999);
+        }
+
         return $clauses;
     }
 
@@ -362,7 +388,7 @@ public function fltPostsWhere($where, $args = [])
                 if (!$required_operation = apply_filters('presspermit_get_posts_operation', '', $args)) {
                     if (defined('REST_REQUEST') && REST_REQUEST) {
                         if (PWP::is_REQUEST('context', 'edit')) {
-                            $required_operation = (!PWP::empty_REQUEST('parent_exclude')) ? 'associate' : 'edit'; // todo: better criteria
+                            $required_operation = (!PWP::empty_REQUEST('parent_exclude') && !presspermit()->getOption('page_parent_editable_only')) ? 'associate' : 'edit'; // todo: better criteria
                         } else {
                             $required_operation = 'read';
                         }

diff --git a/classes/PublishPress/Permissions/TermFilters.php b/classes/PublishPress/Permissions/TermFilters.php
@@ -233,7 +233,7 @@ public function fltGetTermsArgs($args, $taxonomies)
                 if (!empty($rest->operation)) {
                     $args['required_operation'] = $rest->operation;
                 } else {
-                	$args['required_operation'] = ('WP_REST_Posts_Controller' == $rest->endpoint_class) ? 'assign' : 'manage';
+                    $args['required_operation'] = ('WP_REST_Posts_Controller' == $rest->endpoint_class) ? 'assign' : 'manage';
                 }
 
                 if (!defined('PRESSPERMIT_LEGACY_TERM_FILTERS_ARGS')) {

diff --git a/classes/PublishPress/Permissions/UI/AgentPermissions.php b/classes/PublishPress/Permissions/UI/AgentPermissions.php
@@ -244,7 +244,7 @@ class="regular-text" <?php echo esc_attr($disabled); ?> />
                                         <?php elseif ($agent_id) : ?>
                                             <tr>
                                                 <th>
-                                                    <label for="description"><?php echo esc_html(PWP::__wp('Description:', 'press-permit-core')); ?></label>
+                                                    <label for="description"><?php echo esc_html__('Description:', 'press-permit-core'); ?></label>
                                                 </th>
                                                 <td>
                                                     <textarea name="description" id="description" rows="3" cols="40" class="regular-text <?php echo esc_attr($disabled); ?>"><?php echo esc_html($agent->group_description) ?></textarea>

diff --git a/classes/PublishPress/Permissions/UI/AgentsDynamicUI.php b/classes/PublishPress/Permissions/UI/AgentsDynamicUI.php
@@ -271,7 +271,7 @@ private function registerAjaxScripts($agent_type, $id_sfx, $context = '', $agent
         	// @todo: API
             $_args = ['omit_admins' => '1', 'metagroups' => 0];
 
-            if (!empty($_REQUEST['page']) && ('presspermit-edit-permissions' == $_REQUEST['page'])) {
+            if (!PWP::empty_REQUEST('page') && PWP::REQUEST_key_match('page', 'presspermit-edit-permissions')) {   
                 if ($group = presspermit()->groups()->getGroupByName('[Pending Revision Monitors]')) {
                     if ($group->ID == $agent_id) {
                         $_args['omit_admins'] = 0;

diff --git a/classes/PublishPress/Permissions/UI/Dashboard/TermEdit.php b/classes/PublishPress/Permissions/UI/Dashboard/TermEdit.php
@@ -23,7 +23,7 @@ public function __construct()
 	        if ($taxonomy = PWP::REQUEST_key('taxonomy')) {
 	            if (presspermit()->isTaxonomyEnabled($taxonomy)) {
 	                add_action('admin_head', [$this, 'actScriptsWP']);
-	
+
 	                add_action("{$taxonomy}_edit_form", [$this, 'actExceptionEditUI']);
 
 	            } elseif (defined('PRESSPERMIT_LEGACY_TAXONOMY_ENABLE_METABOX')) {

diff --git a/classes/PublishPress/Permissions/UI/Dashboard/UsersListing.php b/classes/PublishPress/Permissions/UI/Dashboard/UsersListing.php
@@ -5,8 +5,6 @@
 class UsersListing
 {
     public function __construct() {
-
-
         add_filter('manage_users_columns', [$this, 'fltUsersColumns']);
         add_filter('manage_users_custom_column', [$this, 'fltUsersCustomColumn'], 99, 3); // filter late in case other plugin filters do not retain passed value
         add_filter('manage_users_sortable_columns', [$this, 'fltUsersColumnsSortable']);
@@ -106,7 +104,7 @@ public static function fltUsersColumns($defaults)
         unset($defaults['role']);
 
         if (defined('PRESSPERMIT_USERS_HIDE_BBP_ROLE')) {
-        	unset($defaults['bbp_user_role']);
+            unset($defaults['bbp_user_role']);
         }
 
         $title = esc_html__('Click to show only users who have specific permissions', 'press-permit-core');

diff --git a/classes/PublishPress/Permissions/UI/SettingsTabCore.php b/classes/PublishPress/Permissions/UI/SettingsTabCore.php
@@ -147,6 +147,10 @@ public function optionsUI()
                         $option_name = 'enabled_post_types';
                         esc_html_e('Modify permissions for these Post Types:', 'press-permit-core');
                         $types = get_post_types(['public' => true, 'show_ui' => true], 'object', 'or');
+                                                                                                                // phpcs:ignore Squiz.PHP.CommentedOutCode.Found
+                        $supported_private_types = apply_filters('presspermit_supported_private_types', []);    // ['series_grouping']);
+
+                        $types = array_merge($types, array_fill_keys($supported_private_types, true));
 
                         // todo: review wp_block permissions filtering
                         $omit_types = apply_filters('presspermit_unfiltered_post_types', ['wp_block']);