diff --git a/phpstan.neon.dist b/phpstan.neon.dist index 6119da1d..9e169c6f 100644 --- a/phpstan.neon.dist +++ b/phpstan.neon.dist @@ -18,6 +18,7 @@ parameters: - tests/phpstan/stubs.php dynamicConstantNames: - CRONTROL_DISALLOW_PHP_EVENTS + - CRONTROL_DISALLOW_URL_EVENTS - DISABLE_WP_CRON WPCompat: pluginFile: wp-crontrol.php diff --git a/src/bootstrap.php b/src/bootstrap.php index a0ab5f48..c856a8c0 100644 --- a/src/bootstrap.php +++ b/src/bootstrap.php @@ -164,6 +164,9 @@ function action_handle_posts() { if ( PHPCronEvent::HOOK_NAME === $cr->hookname ) { wp_die( esc_html__( 'You are not allowed to add new PHP cron events.', 'wp-crontrol' ), 403 ); } + if ( URLCronEvent::HOOK_NAME === $cr->hookname ) { + wp_die( esc_html__( 'You are not allowed to add new URL cron events.', 'wp-crontrol' ), 403 ); + } $args = json_decode( $cr->args, true ); if ( empty( $args ) || ! is_array( $args ) ) { @@ -217,8 +220,8 @@ function action_handle_posts() { exit; } elseif ( isset( $_POST['crontrol_action'] ) && ( 'new_url_cron' === $_POST['crontrol_action'] ) ) { - if ( ! current_user_can( 'manage_options' ) ) { - wp_die( esc_html__( 'You are not allowed to add new cron events.', 'wp-crontrol' ), 403 ); + if ( ! current_user_can_manage_url_cron_events() ) { + wp_die( esc_html__( 'You are not allowed to add new URL cron events.', 'wp-crontrol' ), 403 ); } check_admin_referer( 'crontrol-new-cron' ); @@ -262,7 +265,7 @@ function action_handle_posts() { return $event; }, 99 ); - $added = Event\add( $next_run_local, $cr->schedule, 'crontrol_url_cron_job', $args ); + $added = Event\add( $next_run_local, $cr->schedule, URLCronEvent::HOOK_NAME, $args ); $hookname = ( ! empty( $cr->eventname ) ) ? $cr->eventname : __( 'URL Cron', 'wp-crontrol' ); $redirect = array( @@ -325,7 +328,7 @@ function action_handle_posts() { return $event; }, 99 ); - $added = Event\add( $next_run_local, $cr->schedule, 'crontrol_cron_job', $args ); + $added = Event\add( $next_run_local, $cr->schedule, PHPCronEvent::HOOK_NAME, $args ); $hookname = ( ! empty( $cr->eventname ) ) ? $cr->eventname : __( 'PHP Cron', 'wp-crontrol' ); $redirect = array( @@ -355,6 +358,10 @@ function action_handle_posts() { wp_die( esc_html__( 'You are not allowed to edit PHP cron events.', 'wp-crontrol' ), 403 ); } + if ( URLCronEvent::HOOK_NAME === $cr->hookname && ! current_user_can_manage_url_cron_events() ) { + wp_die( esc_html__( 'You are not allowed to edit URL cron events.', 'wp-crontrol' ), 403 ); + } + $args = json_decode( $cr->args, true ); if ( empty( $args ) || ! is_array( $args ) ) { @@ -499,7 +506,7 @@ function action_handle_posts() { return $event; }, 99 ); - $added = Event\add( $next_run_local, $cr->schedule, 'crontrol_url_cron_job', $args ); + $added = Event\add( $next_run_local, $cr->schedule, URLCronEvent::HOOK_NAME, $args ); if ( is_wp_error( $added ) ) { set_message( $added->get_error_message() ); @@ -581,7 +588,7 @@ function action_handle_posts() { return $event; }, 99 ); - $added = Event\add( $next_run_local, $cr->schedule, 'crontrol_cron_job', $args ); + $added = Event\add( $next_run_local, $cr->schedule, PHPCronEvent::HOOK_NAME, $args ); if ( is_wp_error( $added ) ) { set_message( $added->get_error_message() ); @@ -721,10 +728,13 @@ function action_handle_posts() { $deleted = false; check_admin_referer( "crontrol-delete-hook_{$hook}" ); - // Sanity check + // Sanity checks if ( PHPCronEvent::HOOK_NAME === $hook ) { wp_die( esc_html__( 'You are not allowed to delete PHP cron events.', 'wp-crontrol' ), 403 ); } + if ( URLCronEvent::HOOK_NAME === $hook ) { + wp_die( esc_html__( 'You are not allowed to delete URL cron events.', 'wp-crontrol' ), 403 ); + } $deleted = wp_unschedule_hook( $hook, true ); @@ -774,6 +784,10 @@ function action_handle_posts() { wp_die( esc_html__( 'You are not allowed to run cron events.', 'wp-crontrol' ), 403 ); } + if ( ( URLCronEvent::HOOK_NAME === $hook ) && ! url_cron_events_enabled() ) { + wp_die( esc_html__( 'You are not allowed to run cron events.', 'wp-crontrol' ), 403 ); + } + $ran = Event\run( $hook, $sig ); $redirect = array( @@ -855,7 +869,7 @@ function action_handle_posts() { $hook = wp_unslash( $_GET['crontrol_id'] ); - if ( PHPCronEvent::HOOK_NAME === $hook ) { + if ( ( PHPCronEvent::HOOK_NAME === $hook ) || ( URLCronEvent::HOOK_NAME === $hook ) ) { wp_die( esc_html__( 'You are not allowed to pause or resume cron events.', 'wp-crontrol' ), 403 ); } @@ -939,13 +953,15 @@ function action_handle_posts() { if ( $event->is_php_cron() ) { $args = __( 'PHP Code', 'wp-crontrol' ); + } elseif ( $event->is_url_cron() ) { + $args = $event->args[0]['method'] . ' ' . $event->args[0]['url']; } elseif ( empty( $event->args ) ) { $args = ''; } else { $args = \Crontrol\json_output( $event->args, false ); } - if ( $event->is_php_cron() ) { + if ( ( PHPCronEvent::HOOK_NAME === $event->hook ) || ( URLCronEvent::HOOK_NAME === $event->hook ) ) { $action = 'WP Crontrol'; } else { $callbacks = array(); @@ -1631,7 +1647,15 @@ function show_cron_form( $editing ) { } $can_manage_php = current_user_can_manage_php_cron_events(); - $allowed = ( ! $is_editing_php || $can_manage_php ); + $can_manage_url = current_user_can_manage_url_cron_events(); + + if ( $is_editing_php ) { + $allowed = $can_manage_php; + } elseif ( $is_editing_url ) { + $allowed = $can_manage_url; + } else { + $allowed = true; + } ?>