Merge pull request #624 from ProgressPlanner/filip/v19/filter-out-providers-by-cap

Dont display tasks to users which dont't have capability to complete them

Author: aristath

classes/admin/class-enqueue.php

@@ -214,6 +214,17 @@ public function localize_script( $handle, $localize_data = [] ) {
 					$delay_celebration = \progress_planner()->get_plugin_upgrade_tasks()->should_show_upgrade_popover();
 				}
 
+				// Get the providers available for the user.
+				$include_providers            = [];
+				$providers_available_for_user = \progress_planner()->get_suggested_tasks()->get_tasks_manager()->get_task_providers_available_for_user();
+				foreach ( $providers_available_for_user as $provider ) {
+					// Skip user provider.
+					if ( 'user' === $provider->get_provider_id() ) {
+						continue;
+					}
+					$include_providers[] = $provider->get_provider_id();
+				}
+
 				// Check if user wants to see all recommendations.
 				$show_all_recommendations = isset( $_GET['prpl_show_all_recommendations'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				$tasks_per_page           = $show_all_recommendations ? -1 : \Progress_Planner\Admin\Widgets\Suggested_Tasks::PER_PAGE_DEFAULT;
@@ -223,15 +234,15 @@ public function localize_script( $handle, $localize_data = [] ) {
 					[
 						'post_status'      => 'publish',
 						'posts_per_page'   => $tasks_per_page,
-						'exclude_provider' => [ 'user' ],
+						'include_provider' => $include_providers, // User provider is already excluded.
 					]
 				);
 				// Get pending celebration tasks.
 				$pending_celebration_tasks = \progress_planner()->get_suggested_tasks()->get_tasks_in_rest_format(
 					[
 						'post_status'      => 'pending',
 						'posts_per_page'   => 100,
-						'exclude_provider' => [ 'user' ],
+						'include_provider' => $include_providers, // User provider is already excluded.
 					]
 				);
 

classes/admin/class-page-settings.php

@@ -133,9 +133,6 @@ public function store_settings_form_options() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
 		}
 
-		// Check the nonce.
-		\check_admin_referer( 'progress_planner' );
-
 		// Use check_ajax_referer instead of check_admin_referer for AJAX handlers.
 		// check_admin_referer is designed for form submissions, not AJAX requests.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {

classes/class-suggested-tasks.php

@@ -446,16 +446,6 @@ public function register_taxonomy() {
 	public function rest_api_tax_query( $args, $request ) {
 		$tax_query = [];
 
-		// Include terms (matches any term in list).
-		if ( isset( $request['provider'] ) ) {
-			$tax_query[] = [
-				'taxonomy' => 'prpl_recommendations_provider',
-				'field'    => 'slug',
-				'terms'    => \explode( ',', $request['provider'] ),
-				'operator' => 'IN',
-			];
-		}
-
 		// Exclude terms.
 		if ( isset( $request['exclude_provider'] ) ) {
 			$tax_query[] = [
@@ -466,10 +456,27 @@ public function rest_api_tax_query( $args, $request ) {
 			];
 		}
 
-		if ( ! empty( $tax_query ) ) {
-			$args['tax_query'] = $tax_query; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query
+		$include_providers            = [];
+		$providers_available_for_user = \progress_planner()->get_suggested_tasks()->get_tasks_manager()->get_task_providers_available_for_user();
+		foreach ( $providers_available_for_user as $provider ) {
+			$include_providers[] = $provider->get_provider_id();
 		}
 
+		// Include terms (matches any term in list).
+		if ( isset( $request['provider'] ) ) {
+			$request_providers = \explode( ',', $request['provider'] );
+			$include_providers = \array_intersect( $include_providers, $request_providers );
+		}
+
+		$tax_query[] = [
+			'taxonomy' => 'prpl_recommendations_provider',
+			'field'    => 'slug',
+			'terms'    => $include_providers,
+			'operator' => 'IN',
+		];
+
+		$args['tax_query'] = $tax_query; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query
+
 		// Handle sorting parameters.
 		if ( isset( $request['filter']['orderby'] ) ) {
 			$args['orderby'] = \sanitize_sql_orderby( $request['filter']['orderby'] );

classes/suggested-tasks/class-tasks-manager.php

@@ -196,6 +196,20 @@ public function get_task_providers() {
 		return $this->task_providers;
 	}
 
+	/**
+	 * Get the user available task providers, based on the capability required and the user role.
+	 *
+	 * @return array
+	 */
+	public function get_task_providers_available_for_user() {
+		return \array_filter(
+			$this->task_providers,
+			function ( $task_provider ) {
+				return $task_provider->capability_required();
+			}
+		);
+	}
+
 	/**
 	 * Get a task provider by its ID.
 	 *

classes/suggested-tasks/providers/class-email-sending.php

@@ -263,9 +263,6 @@ public function ajax_test_email_sending() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
 		}
 
-		// Check the nonce.
-		\check_admin_referer( 'progress_planner' );
-
 		// Use check_ajax_referer for AJAX handlers.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );