<?php
/**
* The AWB_Access_Control class.
*
* @package fusion-builder
*/
// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
/**
* The AWB_Access_Control class.
*
* @since 3.9
*/
class AWB_Access_Control {
/**
* The one, true instance of this object.
*
* @static
* @access private
* @since 3.9
* @var object
*/
private static $instance;
/**
* Disabled post types.
*
* @access private
* @since 3.9
* @var array
*/
private static $allowed_post_types = [
'fusion_tb_layout',
'fusion_tb_section',
'awb_off_canvas',
'fusion_icons',
'fusion_form',
'slide',
'fusion_template',
'fusion_element',
'avada_library',
'avada_portfolio',
'avada_faq',
'post',
'page',
];
/**
* Capabilities data.
*
* @access private
* @since 3.9
* @var array
*/
private static $capabilities;
/**
* Constructor.
*
* @access public
*/
public function __construct() {
$this->set_capabilities();
$this->add_hooks();
}
/**
* Creates or returns an instance of this class.
*
* @static
* @access public
* @since 3.9
* @return object
*/
public static function get_instance() {
// If an instance hasn't been created and set to $instance create an instance and set it to $instance.
if ( null === self::$instance ) {
self::$instance = new AWB_Access_Control();
}
return self::$instance;
}
/**
* Sets capabilities from fusion settings.
*
* @since 3.9
* @access private
* @return void
*/
private function set_capabilities() {
$option = get_option( 'fusion_builder_settings', [] );
if ( null === self::$capabilities && isset( $option['capabilities'] ) ) {
self::$capabilities = $option['capabilities'];
}
}
/**
* Adds necessary hooks for access control.
*
* @since 3.9
* @access private
* @return void
*/
private function add_hooks() {
// Live editor access.
add_filter( 'fusion_load_live_editor', [ $this, 'load_live_editor' ], PHP_INT_MAX, 1 );
// Backend builder access.
add_filter( 'awb_load_builder', [ $this, 'load_builder' ], PHP_INT_MAX, 1 );
// Page Options.
add_filter( 'awb_add_po_metabox', [ $this, 'page_options' ], PHP_INT_MAX, 2 );
// Dashboard Menu CPTs.
add_filter( 'awb_dashboard_menu_cpt', [ $this, 'dashboard_menu_cpt' ], PHP_INT_MAX, 2 );
// Form submissions filter.
add_filter( 'awb_view_forms_submissions', [ $this, 'forms_submissions' ], PHP_INT_MAX, 1 );
// Live editor new post menu.
add_filter( 'awb_live_editor_cpt', [ $this, 'live_editor_cpt' ], PHP_INT_MAX, 2 );
// Dashboard Menu Options.
add_filter( 'awb_dashboard_options_menu', [ $this, 'dashboard_menu_options' ], PHP_INT_MAX, 1 );
// Global elements.
add_filter( 'awb_global_elements_access', [ $this, 'global_element_access' ], PHP_INT_MAX, 1 );
// Global elements hook.
add_action( 'load-post.php', [ $this, 'direct_edit_access' ] );
}
/**
* Should user be able to access the dashboard options menu?
*
* @since 3.9
* @access public
* @param bool $default Current default value.
* @return bool
*/
public function dashboard_menu_options( $default ) {
return $this->request_general_filter( $default, 'global_options' );
}
/**
* Should user be able to access the global elements?
*
* @since 3.9
* @access public
* @param bool $default Current default value.
* @return bool
*/
public function global_element_access( $default ) {
return $this->request_general_filter( $default, 'global_elements' );
}
/**
* Should user be able to access the forms submissions?
*
* @since 3.9.2
* @access public
* @param bool $default Current default value.
* @return bool
*/
public function forms_submissions( $default ) {
return $this->request_general_filter( $default, 'fusion_form_submissions' );
}
/**
* Should user be able to edit the post directly?
*
* @since 3.9
* @access public
* @return void
*/
public function direct_edit_access() {
$post_id = isset( $_GET['post'] ) ? sanitize_text_field( wp_unslash( $_GET['post'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification
$post_type = get_post_type( $post_id );
if ( $post_type ) {
// Skip built in posts.
if ( in_array( $post_type, [ 'post', 'page' ], true ) ) {
return;
}
// Global elements access.
if ( isset( $post_id ) && 'yes' === get_post_meta( $post_id, '_fusion_is_global', true ) && ! apply_filters( 'awb_global_elements_access', true ) ) {
wp_die( __( 'Sorry, you are not allowed to access this page.' ), 403 ); // phpcs:ignore WordPress.Security.EscapeOutput
}
// CPTs access.
if ( in_array( $post_type, self::get_allowed_post_types(), true ) && ! apply_filters( 'awb_dashboard_menu_cpt', true, $post_type ) ) {
wp_die( __( 'Sorry, you are not allowed to access this page.' ), 403 ); // phpcs:ignore WordPress.Security.EscapeOutput
}
}
}
/**
* Should user be able to access the dashboard CPT menu?
*
* @since 3.9
* @access public
* @param bool $default Current default value.
* @param string $post_type Current post type.
* @return bool
*/
public function dashboard_menu_cpt( $default, $post_type ) {
$post_type = empty( $post_type ) ? $this->get_current_post_type() : $post_type;
if ( 'post' === $post_type || 'page' === $post_type ) {
return true;
}
return $this->request_cpt_filter( $default, $post_type, 'dashboard_menu' );
}
/**
* Should user be able to access the Live editor CPT menu?
*
* @since 3.9
* @access public
* @param bool $default Current default value.
* @param string $post_type Current post type.
* @return bool
*/
public function live_editor_cpt( $default, $post_type ) {
$post_type = empty( $post_type ) ? $this->get_current_post_type() : $post_type;
return $this->request_cpt_filter( $default, $post_type, 'avada_live' );
}
/**
* Should user be able to access page options?
*
* @since 3.9
* @access public
* @param bool $default Current default value.
* @param string $post_type Current post type.
* @return bool
*/
public function page_options( $default, $post_type ) {
return $this->request_cpt_filter( $default, $post_type, 'page_options' );
}
/**
* Live editor filter.
*
* @since 3.9
* @access public
* @param bool $default The default value.
* @return bool
*/
public function load_live_editor( $default ) {
$post_type = $this->get_current_post_type();
return $this->request_cpt_filter( $default, $post_type, 'avada_live' );
}
/**
* Live builder.
*
* @since 3.9
* @access public
* @param bool $default The default value.
* @return bool
*/
public function load_builder( $default ) {
$post_type = $this->get_current_post_type();
return $this->request_cpt_filter( $default, $post_type, 'avada_builder' );
}
/**
* Filters general request.
*
* @since 3.9
* @access public
* @param bool $default Current default value.
* @param string $request request type.
* @return bool
*/
public function request_general_filter( $default, $request ) {
if ( $this->is_administrator() ) {
return true;
}
if ( ! $this->role_can( $this->get_current_user_highest_role(), $request ) ) {
$default = false;
}
return $default;
}
/**
* Filters CTP request.
*
* @since 3.9
* @access public
* @param bool $default Current default value.
* @param string $post_type Current post type.
* @param string $request request type.
* @return bool
*/
public function request_cpt_filter( $default, $post_type, $request ) {
if ( $this->is_administrator() || ! in_array( $post_type, self::get_allowed_post_types(), true ) ) {
return true;
}
if ( ! $this->role_can_for_cpt( $this->get_current_user_highest_role(), $request, $post_type ) ) {
$default = false;
}
return $default;
}
/**
* Checks if role has specified access for CPT.
*
* @since 3.9
* @access private
* @param string $role The role.
* @param string $type The access type.
* @param string $post_type The post type.
* @return bool
*/
private function role_can_for_cpt( $role, $type, $post_type ) {
$post_type = in_array( $post_type, [ 'fusion_template', 'fusion_element' ], true ) ? 'avada_library' : $post_type;
$role = $this->get_role_id( $role );
if ( ( in_array( $post_type, self::get_allowed_post_types(), true ) && is_array( self::$capabilities ) && isset( self::$capabilities[ $role ] ) && in_array( $post_type . '_' . $type, self::$capabilities[ $role ], true ) ) || null === self::$capabilities ) {
return true;
}
return false;
}
/**
* Checks if role has specified access.
*
* @since 3.9
* @access private
* @param string $role The role.
* @param string $type The access type.
* @return bool
*/
private function role_can( $role, $type ) {
$role = $this->get_role_id( $role );
if ( ( is_array( self::$capabilities ) && isset( self::$capabilities[ $role ] ) && in_array( $type, self::$capabilities[ $role ], true ) ) || null === self::$capabilities ) {
return true;
}
return false;
}
/**
* Gets role ID.
*
* @since 3.9
* @access private
* @param string $role The role.
* @return string
*/
private function get_role_id( $role ) {
return strtolower( str_replace( [ ' ', '-' ], '_', $role ) );
}
/**
* Gets current post type.
*
* @since 3.9
* @access private
* @return string
*/
private function get_current_post_type() {
global $typenow, $pagenow;
$post_type = $typenow;
if ( is_admin() ) {
if ( 'edit.php' === $pagenow && '' === $typenow ) {
$post_type = 'post';
}
if ( '' === $post_type ) {
$post_type = $this->get_custom_screen_post_type();
}
} elseif ( ! is_admin() && isset( $_SERVER['REQUEST_URI'] ) && false === strpos( $_SERVER['REQUEST_URI'], 'fb-edit' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
$post_type = get_post_type();
} elseif ( isset( $_SERVER['REQUEST_URI'] ) && false !== strpos( $_SERVER['REQUEST_URI'], 'fb-edit' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
$post_type = $this->get_live_editor_post_type();
}
$post_type = in_array( $post_type, [ 'fusion_template', 'fusion_element' ], true ) ? 'avada_library' : $post_type;
return apply_filters( 'awb_access_control_current_screen_post_type', $post_type );
}
/**
* Gets current page post type in live editor.
*
* @since 3.9
* @access private
* @return string
*/
private function get_live_editor_post_type() {
global $wp_rewrite;
$fusion_settings = class_exists( 'Fusion_Settings' ) ? awb_get_fusion_settings() : false;
$url = $this->get_current_page_url();
$post_type = '';
$portfolio_slug = $fusion_settings && '' !== $fusion_settings->get( 'portfolio_slug' ) ? $fusion_settings->get( 'portfolio_slug' ) : 'portfolio-items';
$faqs_slug = $fusion_settings && '' !== $fusion_settings->get( 'faq_slug' ) ? $fusion_settings->get( 'faq_slug' ) : 'faq-items';
$post_types = [
'awb_off_canvas' => 'awb_off_canvas',
'fusion_tb_section' => 'fusion_tb_section',
'fusion_form' => 'fusion_form',
'fusion_element' => 'fusion_element',
'fusion_template' => 'fusion_template',
'avada_portfolio' => $portfolio_slug,
'avada_faq' => $faqs_slug,
];
foreach ( $post_types as $item ) {
if ( false !== strpos( $url, $item ) ) {
$post_type = $item;
break;
}
}
if ( empty( $post_type ) && ! is_null( $wp_rewrite ) ) {
$post_type = get_post_type( url_to_postid( $url ) );
}
if ( false === $post_type && get_home_url() === $url && 'page' === get_option( 'show_on_front' ) ) {
$post_type = 'page';
}
return $post_type;
}
/**
* Gets current page URL.
*
* @since 3.9.2
* @access private
* @return string
*/
private function get_current_page_url() {
$url = '';
if ( isset( $_SERVER['HTTPS'] ) && 'on' === $_SERVER['HTTPS'] ) {
$url = 'https://';
} else {
$url = 'http://';
}
$url .= isset( $_SERVER['HTTP_HOST'] ) ? $_SERVER['HTTP_HOST'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
$url .= isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
return $url;
}
/**
* Gets post type for custom screens.
*
* @since 3.9
* @access private
* @return string
*/
private function get_custom_screen_post_type() {
$page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification
$screens = [
'avada-layout-sections' => 'fusion_tb_section',
'avada-off-canvas' => 'awb_off_canvas',
'avada-icons' => 'fusion_icons',
'avada-forms' => 'fusion_form',
'avada-form-entries' => 'fusion_form',
'avada-library' => 'avada_library',
];
return isset( $screens[ $page ] ) ? $screens[ $page ] : '';
}
/**
* Checks if current user is administrator.
*
* @since 3.9
* @access private
* @return bool
*/
private function is_administrator() {
return current_user_can( 'administrator' );
}
/**
* Gets current logged in user highest role.
*
* @since 3.9
* @access private
* @return string
*/
private function get_current_user_highest_role() {
$role = [];
if ( is_user_logged_in() ) {
$user = wp_get_current_user();
$user_roles = (array) $user->roles;
foreach ( $user_roles as $user_role ) {
$role_data = get_role( $user_role );
$capabilities_count = isset( $role_data->capabilities ) ? count( $role_data->capabilities ) : 0;
if ( empty( $role ) ) {
$role['role'] = $user_role;
$role['capabilities'] = $capabilities_count;
} elseif ( $capabilities_count > $role['capabilities'] ) {
$role['role'] = $user_role;
$role['capabilities'] = $capabilities_count;
}
}
}
if ( isset( $role['role'] ) && isset( wp_roles()->get_names()[ $role['role'] ] ) ) {
return $this->get_role_id( wp_roles()->get_names()[ $role['role'] ] );
} else {
return '';
}
}
/**
* Checks if current capability is available for role and echos/returns checked.
*
* @since 3.9
* @access public
* @param string $role_id The role ID.
* @param string $capability The capability to check for.
* @param bool $echo Should echo or return value.
* @return mixed
*/
public static function maybe_checked( $role_id, $capability, $echo = true ) {
if ( ( is_array( self::$capabilities ) && isset( self::$capabilities[ $role_id ] ) && in_array( $capability, self::$capabilities[ $role_id ], true ) ) || null === self::$capabilities ) {
if ( $echo ) {
echo 'checked';
} else {
return 'checked';
}
}
}
/**
* Creates dummy library object.
*
* @since 3.9
* @access public
* @return object
*/
public static function get_library_object() {
$obj = new stdClass();
$obj->label = __( 'Avada Library', 'fusion-builder' );
$obj->name = 'avada_library';
return $obj;
}
/**
* Prefixes Avada in post label if does not exist.
*
* @since 3.9
* @param array $post The post object.
* @access public
* @return string
*/
public static function get_post_type_label( $post ) {
$label = '';
if ( ( is_object( $post ) && property_exists( $post, '_builtin' ) && $post->_builtin ) || false !== strpos( $post->label, 'Avada' ) ) {
$label = $post->label;
} else {
$label = __( 'Avada', 'fusion-builder' ) . ' ' . $post->label;
}
return apply_filters( 'awb_access_control_post_type_label', $label );
}
/**
* Method to display options.
*
* @since 3.9
* @access public
* @return void
*/
public static function display_options() {
$roles = self::get_user_roles();
$post_types = self::get_allowed_post_types();
// Remove templates and elements. So that library option can be used for both.
$post_types = array_diff( $post_types, [ 'fusion_template', 'fusion_element' ] );
foreach ( $roles as $role ) {
self::display_options_for_a_role( $role, $post_types );
}
}
/**
* Displays options for a role.
*
* @since 3.9
* @param array $role Object of user role.
* @param array $post_types Object of post types.
* @access private
* @return void
*/
private static function display_options_for_a_role( $role, $post_types ) {
$template = locate_template( [ 'template-user-roles.php' ] );
if ( ! empty( $template ) ) {
include $template;
} else {
include FUSION_BUILDER_PLUGIN_DIR . 'templates/template-user-roles.php';
}
}
/**
* Gets user roles.
*
* @access public
* @return array
*/
public static function get_user_roles() {
$roles = get_editable_roles();
// Remove admin role.
unset( $roles['administrator'] );
return $roles;
}
/**
* Checks if role has got specific WP core capabilities.
*
* @since 3.9
* @param string $role The WP user role.
* @param array $capabilities Array of capabilities.
* @param string $operator The and/or operator.
* @access private
* @return boolean
*/
public static function wp_role_has_core_capability( $role, $capabilities, $operator = 'and' ) {
$role_can = false;
foreach ( $capabilities as $capability ) {
if ( isset( $role['capabilities'][ $capability ] ) && true === $role['capabilities'][ $capability ] ) {
$role_can = true;
} elseif ( 'and' === $operator ) {
$role_can = false;
break;
}
}
return $role_can;
}
/**
* Checks if user has certain WP core capability for a post.
*
* @since 3.9
* @param string $post_type The post type.
* @param string $capability The capability.
* @access private
* @return boolean
*/
public static function wp_user_can_for_post( $post_type, $capability ) {
$post_type_object = get_post_type_object( $post_type );
return current_user_can( $post_type_object->cap->{$capability} );
}
/**
* Gets allowed post types.
*
* @access public
* @return array
*/
public static function get_allowed_post_types() {
return apply_filters( 'awb_access_control_post_types', self::$allowed_post_types );
}
}
/**
* Instantiates the AWB_Access_Control class.
* Make sure the class is properly set-up.
*
* @since object 3.9
* @return object AWB_Access_Control
*/
function AWB_Access_Control() { // phpcs:ignore WordPress.NamingConventions
return AWB_Access_Control::get_instance();
}
AWB_Access_Control();