Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PROD-7841 #4510

Open
wants to merge 3 commits into
base: release
Choose a base branch
from
Open

PROD-7841 #4510

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4a87745
PROD-7841 - If query parameters exist, append them to the current end…
jitendrabanjara1991 Sep 17, 2024
1d244a4
PROD-7841 - Allow REST API endpoints with query parameters
jitendrabanjara1991 Sep 17, 2024
857c73a
PROD-7841 - Fixed - PHP Warning: preg_match(): Compilation failed: u…
jitendrabanjara1991 Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 27 additions & 6 deletions src/bp-core/bp-core-functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6099,6 +6099,11 @@ function bb_restricate_rss_feed() {
function bb_restricate_rest_api( $response, $handler, $request ) {
// Get current route.
$current_endpoint = $request->get_route();
// Get the query parameters.
$query_params = $request->get_query_params();
if ( ! empty( $query_params ) ) { // If query parameters exist, append them to the current endpoint.
$current_endpoint .= '?' . urldecode( http_build_query( $query_params ) );
}
// Add mandatory endpoint here for app which you want to exclude from restriction.
// ex: /buddyboss-app/auth/v1/jwt/token.
$default_exclude_endpoint = array(
Expand Down Expand Up @@ -6133,16 +6138,32 @@ function bb_restricate_rest_api( $response, $handler, $request ) {
* @return bool true Return true if allow endpoint otherwise return false.
*/
function bb_is_allowed_endpoint( $current_endpoint ) {
$current_endpoint = trailingslashit( bp_get_root_domain() ) . 'wp-json' . $current_endpoint;
$exploded_endpoint = explode( 'wp-json', $current_endpoint );
$exclude_endpoints = bb_enable_private_rest_apis_public_content();
$current_endpoint_path = parse_url( $current_endpoint, PHP_URL_PATH );
$current_endpoint_query = parse_url( $current_endpoint, PHP_URL_QUERY );
$current_endpoint = trailingslashit( bp_get_root_domain() ) . 'wp-json' . $current_endpoint;
$exploded_endpoint = explode( 'wp-json', $current_endpoint );
$exclude_endpoints = bb_enable_private_rest_apis_public_content();
if ( '' !== $exclude_endpoints ) {
$exclude_arr_endpoints = preg_split( "/\r\n|\n|\r/", $exclude_endpoints );
if ( ! empty( $exclude_arr_endpoints ) && is_array( $exclude_arr_endpoints ) ) {
foreach ( $exclude_arr_endpoints as $endpoints ) {
if ( ! empty( $endpoints ) ) {
$endpoints = untrailingslashit( trim( $endpoints ) );
if ( strpos( $current_endpoint, $endpoints ) !== false ) {
$endpoints = untrailingslashit( trim( $endpoints ) );
$endpoints_path = parse_url( $endpoints, PHP_URL_PATH );
$endpoints_query = parse_url( $endpoints, PHP_URL_QUERY );
if (
empty( $endpoints_query ) &&
strpos( $current_endpoint, $endpoints ) !== false
) {
return true;
} elseif (
! empty( $current_endpoint_path ) &&
! empty( $endpoints_path ) &&
strpos( $current_endpoint_path, $endpoints_path ) !== false &&
! empty( $current_endpoint_query ) &&
! empty( $endpoints_query ) &&
$current_endpoint_query === $endpoints_query
) {
return true;
} else {
if ( strpos( $endpoints, bp_get_root_domain() ) !== false ) {
Expand All @@ -6154,7 +6175,7 @@ function bb_is_allowed_endpoint( $current_endpoint ) {
$endpoints = str_replace( '//', '/', $endpoints );
$endpoints = str_replace( '///', '/', $endpoints );
$endpoints = '/' . ltrim( $endpoints, '/' );
$current_endpoint_allowed = preg_match( '@' . $endpoints . '$@i', end( $exploded_endpoint ), $matches );
$current_endpoint_allowed = preg_match( '@' . preg_quote( $endpoints, '@' ) . '$@i', end( $exploded_endpoint ) );
if ( $current_endpoint_allowed ) {
return true;
}
Expand Down