Changeset 11237

Timestamp:

09/15/2021 06:20:16 AM (3 years ago)

Author:

dd32

Message:

Theme Directory: Introduce a specific constant/key for fetching the SVN Auth file.

This also stops outputting theme access rules until ready.

See #5899.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/rest-api/class-internal.php (modified) (5 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/rest-api/class-internal.php

@@ -11 +11 @@
             'methods'             => \WP_REST_Server::CREATABLE,
             'callback'            => array( $this, 'bulk_update_stats' ),
-            'permission_callback' => array( $this, 'permission_check_internal_api_bearer' ),
+            'permission_callback' => array( $this, 'permission_check_bearer' ),
         ) );
 
@@ -17 +17 @@
             'methods'             => \WP_REST_Server::READABLE,
             'callback'            => array( $this, 'svn_auth' ),
-            'permission_callback' => array( $this, 'permission_check_internal_api_bearer' ),
+            'permission_callback' => function( $request ) {
+                return $this->permission_check_bearer( $request, 'THEME_SVN_AUTH_BEARER_TOKEN' );
+            }
         ) );
     }
@@ -24 +26 @@
      * A Permission Check callback which validates the request with a Bearer token.
      *
-     * @param \WP_REST_Request $request The Rest API Request.
+     * @param \WP_REST_Request $request  The Rest API Request.
+     * @param string           $constant The constant to check.
      * @return bool|\WP_Error True if the token exists, WP_Error upon failure.
      */
-    function permission_check_internal_api_bearer( $request ) {
+    function permission_check_bearer( $request, $constant = 'THEME_API_INTERNAL_BEARER_TOKEN' ) {
         $authorization_header = $request->get_header( 'authorization' );
         $authorization_header = trim( str_ireplace( 'bearer', '', $authorization_header ) );
@@ -33 +36 @@
         if (
             ! $authorization_header ||
-            ! defined( 'THEME_API_INTERNAL_BEARER_TOKEN' ) ||
-            ! hash_equals( THEME_API_INTERNAL_BEARER_TOKEN, $authorization_header )
+            ! defined( $constant ) ||
+            ! hash_equals( constant( $constant ), $authorization_header )
         ) {
             return new WP_Error(
@@ -74 +77 @@
         }
         echo "\n";
+
+        // TODO: Temporarily don't output the Theme Authors until we're ready.
+        exit();
 
         // Theme Authors.