Changeset 13610

Timestamp:

04/29/2024 07:36:53 AM (2 years ago)

Author:

dd32

Message:

Plugin Directory: Add a 'pending plugin' API endpoint to fetch information about a plugin in review.

This is intended to be used by the Reviewer tools, such that the tools can use information known to the plugin directory about the ZIP being reviewed.

See #7385.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory

Files:

• api/class-base.php (modified) (1 diff)
• api/routes/class-pending-plugin.php (added)
• api/routes/class-plugin.php (modified) (2 diffs)
• class-plugin-directory.php (modified) (2 diffs)
• shortcodes/class-upload-handler.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/class-base.php

@@ -40 +40 @@
                 new Routes\Plugin_Upload();
                 new Routes\Plugin_Blueprint();
+                new Routes\Pending_Plugin();
         }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin.php

@@ -39 +39 @@
          */
         function plugin_info( $request ) {
-                $plugin_slug = $request['plugin_slug'];
-
-                global $post;
-                $post = Plugin_Directory::get_plugin_post( $plugin_slug );
-
-                if ( 'publish' != $post->post_status ) {
+                $post = Plugin_Directory::get_plugin_post( $request['plugin_slug'] );
+
+                if ( ! $post || 'publish' != $post->post_status ) {
                         // Copy what the REST API does if the param is incorrect
                         return new \WP_Error(
@@ -58 +55 @@
                 }
 
+                return $this->plugin_info_data( $request, $post );
+        }
+
+        /**
+         * The underlying API for the plugin information.
+         *
+         * Expects that the input has been validated, and that the $post object is safe for display.
+         * This is shared with/called from Pending_Plugin too.
+         *
+         * @param \WP_REST_Request $request The request object.
+         * @param \WP_Post         $post    The post object for the plugin.
+         * @return array The formatted array of all the data for the plugin.
+         */
+        public function plugin_info_data( $request, $post ) {
+                $GLOBALS['post'] = $post;
+                $plugin_slug     = $post->post_name;
+                $post_id         = $post->ID;
+
                 // Support returning API data in different locales, even on wordpress.org (for api.wordpress.org usage)
                 if ( ! empty( $request['locale'] ) && ! in_array( strtolower( $request['locale'] ), array( 'en_us', 'en' ) ) ) {
                         switch_to_locale( $request['locale'] );
                 }
-
-                $post_id = $post->ID;
 
                 $result            = array();

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php

@@ -52 +52 @@
                 add_action( 'wp_head', array( Template::class, 'hreflang_link_attributes' ), 2 );
                 add_filter( 'allowed_redirect_hosts', array( $this, 'filter_redirect_hosts' ) );
+                add_filter( 'wp_get_attachment_url', array( $this, 'add_info_to_zip_url' ), 100, 2 );
 
                 // Add no-index headers where appropriate.
@@ -1832 +1833 @@
 
                 return update_post_meta( $plugin->ID, 'releases', $releases );
+        }
+
+        /**
+         * Add additional context to ZIP urls.
+         *
+         * The ZIP URL will have a 'info' key attached which is a rest api URL to information about the plugin.
+         *
+         * @param string $url           The URL to the ZIP file.
+         * @param int    $attachment_id The attachment ID.
+         * @return string The URL to the ZIP file.
+         */
+        public function add_info_to_zip_url( $url, $attachment_id ) {
+                $attachment = get_post( $attachment_id );
+                $post       = get_post( $attachment->post_parent );
+                $token      = $post->{'_pending_access_token'} ?? false;
+
+                if ( ! $url || ! $attachment || ! $post || ! $token || ! current_user_can( 'edit_post', $post->ID ) ) {
+                        return $url;
+                }
+
+                $url = add_query_arg(
+                        'info',
+                        urlencode( rest_url( sprintf(
+                                'plugins/v1/pending-plugin/%d-%s/',
+                                $post->ID,
+                                $token
+                        ) ) ),
+                        $url
+                );
+
+                return $url;
         }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-upload-handler.php

@@ -469 +469 @@
                 // First time submission, track some additional metadata.
                 if ( ! $updating_existing ) {
-                        $post_args['meta_input']['_author_ip']        = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] );
-                        $post_args['meta_input']['_submitted_date']   = time();
-                        $post_args['meta_input']['_used_upload_token'] = $has_upload_token;
+                        $post_args['meta_input']['_author_ip']            = preg_replace( '/[^0-9a-fA-F:., ]/', '', $_SERVER['REMOTE_ADDR'] );
+                        $post_args['meta_input']['_submitted_date']       = time();
+                        $post_args['meta_input']['_used_upload_token']    = $has_upload_token;
+                        $post_args['meta_input']['_pending_access_token'] = md5( wp_generate_password( 32, true, true ) );
                 }