Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
84.21%
32 / 38
75.00%
3 / 4
 CRAP
0.00%
0 / 1
WPCOM_REST_API_V2_Endpoint_Transient
91.43%
32 / 35
75.00%
3 / 4
 6.02
0.00%
0 / 1
 __construct
0.00%
0 / 3
0.00%
0 / 1
 2
 register_routes
100.00%
19 / 19
100.00%
1 / 1
 1
 delete_transient
100.00%
3 / 3
100.00%
1 / 1
 1
 delete_transient_permissions_check
100.00%
10 / 10
100.00%
1 / 1
 3
1<?php
2/**
3 * REST API endpoint for editing Jetpack Transients.
4 *
5 * @package automattic/jetpack
6 * @since 9.7.0
7 */
8
9if ( ! defined( 'ABSPATH' ) ) {
10    exit( 0 );
11}
12
13/**
14 * Jetpack transients API.
15 *
16 * @since 9.7.0
17 */
18class WPCOM_REST_API_V2_Endpoint_Transient extends WP_REST_Controller {
19    /**
20     * Constructor.
21     */
22    public function __construct() {
23        $this->namespace = 'wpcom/v2';
24        $this->rest_base = 'transients';
25        add_action( 'rest_api_init', array( $this, 'register_routes' ) );
26    }
27
28    /**
29     * Called automatically on `rest_api_init()`.
30     */
31    public function register_routes() {
32        // DELETE /sites/<blog-id>/transients/$name route.
33        register_rest_route(
34            $this->namespace,
35            '/' . $this->rest_base . '/(?P<name>\w{1,172})',
36            array(
37                array(
38                    'methods'             => WP_REST_Server::DELETABLE,
39                    'callback'            => array( $this, 'delete_transient' ),
40                    'permission_callback' => array( $this, 'delete_transient_permissions_check' ),
41                    'args'                => array(
42                        'name' => array(
43                            'description'       => __( 'The name of the transient to delete.', 'jetpack' ),
44                            'required'          => true,
45                            'type'              => 'string',
46                            'sanitize_callback' => 'sanitize_text_field',
47                        ),
48                    ),
49                ),
50            )
51        );
52    }
53
54    /**
55     * Delete transient callback.
56     *
57     * @param \WP_REST_Request $request Full details about the request.
58     * @return array
59     */
60    public function delete_transient( \WP_REST_Request $request ) {
61        return array(
62            'success' => delete_transient( $request->get_param( 'name' ) ),
63        );
64    }
65
66    /**
67     * Check if the user has read access, the transient name starts with
68     * "jetpack_connected_user_data_", and that the user is editing
69     * their own transient.
70     *
71     * @param \WP_REST_Request $request Full details about the request.
72     * @return bool|WP_Error
73     */
74    public function delete_transient_permissions_check( \WP_REST_Request $request ) {
75        $transient_name  = $request->get_param( 'name' );
76        $current_user_id = get_current_user_id();
77
78        if ( current_user_can( 'read' ) &&
79            "jetpack_connected_user_data_{$current_user_id}" === $transient_name ) {
80                return true;
81        } else {
82            return new WP_Error(
83                'authorization_required',
84                __( 'Sorry, you are not allowed to delete this transient.', 'jetpack' ),
85                array( 'status' => 403 )
86            );
87        }
88    }
89}
90
91wpcom_rest_api_v2_load_plugin( 'WPCOM_REST_API_V2_Endpoint_Transient' );