ch_to_post( $editor_post_id ); } $result = call_user_func( [ $this, $ajax_request ], $data ); if ( is_wp_error( $result ) ) { throw new \Exception( $result->get_error_message() ); } return $result; } /** * Init ajax calls. * * Initialize template library ajax calls for allowed ajax requests. * * @since 2.3.0 * @access public * * @param Ajax $ajax */ public function register_ajax_actions( Ajax $ajax ) { $library_ajax_requests = [ 'get_library_data', 'get_template_data', 'save_template', 'update_templates', 'delete_template', 'import_template', 'mark_template_as_favorite', 'import_from_json', ]; foreach ( $library_ajax_requests as $ajax_request ) { $ajax->register_ajax_action( $ajax_request, function( $data ) use ( $ajax_request ) { return $this->handle_ajax_request( $ajax_request, $data ); } ); } } /** * @since 2.3.0 * @access public */ public function handle_direct_actions() { if ( ! User::is_current_user_can_edit_post_type( Source_Local::CPT ) ) { return; } /** @var Ajax $ajax */ $ajax = Plugin::$instance->common->get_component( 'ajax' ); if ( ! $ajax->verify_request_nonce() ) { $this->handle_direct_action_error( 'Access Denied' ); } $action = Utils::get_super_global_value( $_REQUEST, 'library_action' ); // phpcs:ignore -- Nonce already verified. $whitelist_methods = [ 'export_template', 'direct_import_template', ]; if ( 'direct_import_template' === $action && ! User::is_current_user_can_upload_json() ) { return; } if ( in_array( $action, $whitelist_methods, true ) ) { $result = $this->$action( $_REQUEST ); // phpcs:ignore -- Nonce already verified. } else { $result = new \WP_Error( 'method_not_exists', 'Method Not exists' ); } if ( is_wp_error( $result ) ) { /** @var \WP_Error $result */ $this->handle_direct_action_error( $result->get_error_message() . '.' ); } $callback = "on_{$action}_success"; if ( method_exists( $this, $callback ) ) { $this->$callback( $result ); } die; } /** * On successful template import. * * Redirect the user to the template library after template import was * successful finished. * * @since 2.3.0 * @access private */ private function on_direct_import_template_success() { wp_safe_redirect( admin_url( Source_Local::ADMIN_MENU_SLUG ) ); } /** * @since 2.3.0 * @access private */ private function handle_direct_action_error( $message ) { _default_wp_die_handler( $message, 'Elementor Library' ); } /** * Ensure arguments exist. * * Checks whether the required arguments exist in the specified arguments. * * @since 1.0.0 * @access private * * @param array $required_args Required arguments to check whether they * exist. * @param array $specified_args The list of all the specified arguments to * check against. * * @return \WP_Error|true True on success, 'WP_Error' otherwise. */ private function ensure_args( array $required_args, array $specified_args ) { $not_specified_args = array_diff( $required_args, array_keys( $specified_args ) ); if ( $not_specified_args ) { return new \WP_Error( 'arguments_not_specified', sprintf( 'The required argument(s) "%s" not specified.', implode( ', ', $not_specified_args ) ) ); } return true; } private function is_allowed_to_read_template( array $args ): bool { if ( 'remote' === $args['source'] ) { return true; } if ( null === $this->wordpress_adapter ) { $this->set_wordpress_adapter( new WordPress_Adapter() ); } if ( ! $this->should_check_permissions( $args ) ) { return true; } $post_id = intval( $args['template_id'] ); $post_status = $this->wordpress_adapter->get_post_status( $post_id ); $is_private_or_non_published = ( 'private' === $post_status && ! $this->wordpress_adapter->current_user_can( 'read_private_posts', $post_id ) ) || ( 'publish' !== $post_status ); $can_read_template = $is_private_or_non_published || $this->wordpress_adapter->current_user_can( 'edit_post', $post_id ); return apply_filters( 'elementor/template-library/is_allowed_to_read_template', $can_read_template, $args ); } private function should_check_permissions( array $args ): bool { if ( null === $this->elementor_adapter ) { $this->set_elementor_adapter( new Elementor_Adapter() ); } // TODO: Remove $isWidgetTemplate in 3.28.0 as there is a Pro dependency $check_permissions = isset( $args['check_permissions'] ) && false === $args['check_permissions']; $is_widget_template = 'widget' === $this->elementor_adapter->get_template_type( $args['template_id'] ); if ( $check_permissions || $is_widget_template ) { return false; } return true; } }