Merge branch 'dev' into svgo

Author: b-l-i-n-d

assets/src/js/frontend/learning-area/index.ts

@@ -12,6 +12,14 @@ import { initializeQna } from './pages/qna';
 import { initializeQuizInterface } from './quiz';
 import { initializeSidebar } from './sidebar';
 
+const decodePathSegment = (segment: string): string => {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+};
+
 const initializeLearningArea = () => {
   initializeLearningAreaCommon();
   initializeCommon();
@@ -20,8 +28,8 @@ const initializeLearningArea = () => {
   initializeReviews();
   const { pathname, search } = window.location;
 
-  // Normalize path segments
-  const pathSegments = pathname.split('/').filter(Boolean);
+  // Decode URL-encoded path segments before comparing with configured slugs.
+  const pathSegments = pathname.split('/').filter(Boolean).map(decodePathSegment);
   const { tutorConfig } = window.TutorCore.config;
   const { lesson_slug = 'lessons', quiz_slug = 'quizzes' } = tutorConfig || {};
 

assets/src/scss/frontend/learning-area/pages/_quiz-intro.scss

@@ -122,7 +122,7 @@
       grid-template-columns: 324px 190px 1.5fr 1fr !important;
 
       @include tutor-breakpoint-down(sm) {
-        grid-template-columns: auto !important;
+        grid-template-columns: 1fr auto auto auto !important;
       }
     }
 

classes/Assets.php

@@ -199,6 +199,7 @@ function ( $file ) {
 			'placeholder_img_src'          => tutor_placeholder_img_src(),
 			'enable_lesson_classic_editor' => get_tutor_option( 'enable_lesson_classic_editor' ),
 			'tutor_frontend_dashboard_url' => tutor_utils()->get_tutor_dashboard_page_permalink(),
+			'is_dashboard_page'            => tutor_utils()->is_dashboard_page(),
 			'wp_date_format'               => tutor_js_date_format_against_wp(),
 			'start_of_week'                => get_option( 'start_of_week', 1 ),
 			'is_admin'                     => is_admin(),

classes/Quiz.php

@@ -793,7 +793,7 @@ public static function manage_attempt_answers( $attempt_answers, $attempt, $atte
 					$is_answer_was_correct = false;
 					$given_answer          = '';
 
-					if ( 'true_false' === $question_type || 'single_choice' === $question_type ) {
+					if ( QuizModel::QUESTION_TYPE_TRUE_FALSE === $question_type || QuizModel::QUESTION_TYPE_SINGLE_CHOICE === $question_type ) {
 						$given_answer          = $answers;
 						$is_answer_was_correct = (bool) $wpdb->get_var(
 							$wpdb->prepare(
@@ -805,7 +805,7 @@ public static function manage_attempt_answers( $attempt_answers, $attempt, $atte
 							)
 						);
 
-					} elseif ( 'multiple_choice' === $question_type ) {
+					} elseif ( QuizModel::QUESTION_TYPE_MULTIPLE_CHOICE === $question_type ) {
 
 						$given_answer = (array) ( $answers );
 						$given_answer = array_filter( $given_answer, fn ( $id ) => is_numeric( $id ) && intval( $id ) > 0 );
@@ -828,9 +828,10 @@ public static function manage_attempt_answers( $attempt_answers, $attempt, $atte
 						if ( count( array_diff( $get_original_answers, $given_answer ) ) === 0 && count( $get_original_answers ) === count( $given_answer ) ) {
 							$is_answer_was_correct = true;
 						}
-						$given_answer = maybe_serialize( $answers );
 
-					} elseif ( 'fill_in_the_blank' === $question_type ) {
+						$given_answer = maybe_serialize( $given_answer );
+
+					} elseif ( QuizModel::QUESTION_TYPE_FILL_IN_THE_BLANK === $question_type ) {
 
 						$get_original_answer = $wpdb->get_row(
 							$wpdb->prepare(
@@ -869,11 +870,11 @@ function ( $ans ) {
 						if ( strtolower( $given_answer ) === strtolower( $gap_answer ) ) {
 							$is_answer_was_correct = true;
 						}
-					} elseif ( 'open_ended' === $question_type || 'short_answer' === $question_type ) {
+					} elseif ( QuizModel::QUESTION_TYPE_OPEN_ENDED === $question_type || QuizModel::QUESTION_TYPE_SHORT_ANSWER === $question_type ) {
 						$review_required = true;
 						$given_answer    = wp_kses_post( $answers );
 
-					} elseif ( 'ordering' === $question_type || 'matching' === $question_type || 'image_matching' === $question_type ) {
+					} elseif ( QuizModel::QUESTION_TYPE_ORDERING === $question_type || QuizModel::QUESTION_TYPE_MATCHING === $question_type || QuizModel::QUESTION_TYPE_IMAGE_MATCHING === $question_type ) {
 						$answers = (array) tutor_utils()->avalue_dot( 'answers', $answers );
 
 						$given_answer = (array) array_map( 'sanitize_text_field', $answers );
@@ -897,7 +898,7 @@ function ( $ans ) {
 						if ( maybe_serialize( $get_original_answers ) == $given_answer ) {
 							$is_answer_was_correct = true;
 						}
-					} elseif ( 'image_answering' === $question_type ) {
+					} elseif ( QuizModel::QUESTION_TYPE_IMAGE_ANSWERING === $question_type ) {
 						$image_inputs          = tutor_utils()->avalue_dot( 'answer_id', $answers );
 						$image_inputs          = (array) array_map( 'sanitize_text_field', $image_inputs );
 						$given_answer          = maybe_serialize( $image_inputs );
@@ -963,7 +964,7 @@ function ( $ans ) {
 					 * Check if question_type open ended or short ans the set
 					 * is_correct default value null before saving
 					 */
-					if ( in_array( $question_type, array( 'open_ended', 'short_answer', 'image_answering' ) ) ) {
+					if ( in_array( $question_type, QuizModel::get_manual_review_types(), true ) ) {
 						$answers_data['is_correct'] = null;
 						$review_required            = true;
 					}
@@ -1953,6 +1954,10 @@ public static function render_quiz_attempts( $quiz_id ) {
 								)
 							);
 							?>
+
+							<div class="tutor-quiz-item-actions">
+								<?php $quiz_attempt_obj->render_details_button( $attempt, true ); ?>
+							</div>
 						</div>
 						<?php
 					}

classes/Quiz_Attempts_List.php

@@ -467,20 +467,26 @@ public function render_retry_button( $course_id = 0, $quiz_id = 0, $attempt = ar
 	 * @since 4.0.0
 	 *
 	 * @param array $attempt the quiz attempt.
+	 * @param bool  $is_learning_area is learning area list item.
 	 *
 	 * @return void
 	 */
-	public function render_details_button( $attempt ) {
-		if ( User::is_student_view() ) {
-			Button::make()
-				->label( __( 'Details', 'tutor' ) )
-				->icon( Icon::RESOURCES, 'left', 20 )
-				->size( Size::MEDIUM )
-				->tag( 'a' )
-				->attr( 'href', $this->get_review_url( $attempt ) )
-				->variant( 'primary' )
-				->render();
+	public function render_details_button( $attempt, $is_learning_area = false ) {
+		if ( ! User::is_student_view() ) {
+			return;
 		}
+
+		$args = $is_learning_area ? array( 'action' => 'view_details' ) : array();
+		$url  = $this->get_review_url( $attempt, $args );
+
+		Button::make()
+		->label( __( 'Details', 'tutor' ) )
+		->icon( Icon::RESOURCES, 'left', 20 )
+		->size( Size::MEDIUM )
+		->tag( 'a' )
+		->attr( 'href', $url )
+		->variant( 'primary' )
+		->render();
 	}
 
 	/**

classes/RestAPI.php

@@ -116,6 +116,66 @@ public function __construct() {
 		$this->rating_obj       = new REST_Rating();
 
 		add_action( 'rest_api_init', array( $this, 'init_routes' ) );
+		add_filter( 'rest_request_before_callbacks', array( $this, 'check_permission' ), 10, 3 );
+	}
+
+	/**
+	 * Check permission before dispatching REST request.
+	 *
+	 * @todo will remove and prevent by capability where needed.
+	 *
+	 * @since 4.0.1
+	 *
+	 * @param mixed            $response response.
+	 * @param mixed            $handler handler.
+	 * @param \WP_REST_Request $request request.
+	 *
+	 * @return mixed|\WP_Error
+	 */
+	public function check_permission( $response, $handler, $request ) {
+		$id            = absint( $request['id'] );
+		$method        = $request->get_method();
+		$write_methods = array( 'POST', 'PUT', 'PATCH', 'DELETE' );
+		$is_write      = in_array( $method, $write_methods, true );
+
+		if ( ! $id ) {
+			return $response;
+		}
+
+		$post = get_post( $id );
+
+		if ( ! $post ) {
+			return $response;
+		}
+
+		$post_types = array(
+			tutor()->course_post_type,
+			tutor()->bundle_post_type,
+		);
+
+		if ( ! in_array( $post->post_type, $post_types, true ) ) {
+			return $response;
+		}
+
+		// Prevent write actions which are only allowed for author.
+		if ( $is_write && ! current_user_can( 'edit_post', $id ) ) {
+			return new \WP_Error(
+				'rest_forbidden',
+				tutor_utils()->error_message(),
+				array( 'status' => rest_authorization_required_code() )
+			);
+		}
+
+		// Prevent access to non-publish posts, only author can access.
+		if ( 'publish' !== $post->post_status && ! current_user_can( 'edit_post', $id ) ) {
+			return new \WP_Error(
+				'rest_forbidden',
+				tutor_utils()->error_message(),
+				array( 'status' => rest_authorization_required_code() )
+			);
+		}
+
+		return $response;
 	}
 
 	/**

classes/Utils.php

@@ -9819,7 +9819,7 @@ public function error_message( $key = '401' ) {
 	 *
 	 * @since 2.2.4
 	 *
-	 * @param string $plugin_slug
+	 * @param string $plugin_slug plugin slug.
 	 *
 	 * @return object|bool if success return object otherwise return false;
 	 */
@@ -9832,6 +9832,70 @@ public function get_remote_plugin_info( $plugin_slug = 'tutor' ) {
 		return (object) json_decode( $response['body'], true );
 	}
 
+	/**
+	 * Get the latest available version of a plugin from WordPress.org's update-check API,
+	 * with optional transient caching.
+	 *
+	 * @param string $plugin_file  Plugin file path relative to plugins dir, e.g. "tutor/tutor.php".
+	 * @param bool   $use_cache    Whether to read/write the transient cache. Default true.
+	 * @param int    $cache_expiry Cache lifetime in seconds. Default 5 minutes.
+	 *
+	 * @return string|false Latest version string on success, false if not found / on error.
+	 */
+	public function get_wp_org_update_version( $plugin_file, $use_cache = true, $cache_expiry = 5 * MINUTE_IN_SECONDS ) {
+
+		$cache_key = 'wp_org_update_' . md5( $plugin_file );
+
+		if ( $use_cache ) {
+			// Return cached result if available (including cached "not found" results).
+			$cached = get_transient( $cache_key );
+			if ( false !== $cached ) {
+				return ( '__none__' === $cached ) ? false : $cached;
+			}
+		}
+
+		$body = array(
+			'plugins' => wp_json_encode(
+				array(
+					'plugins' => array(
+						$plugin_file => array(),
+					),
+				)
+			),
+		);
+
+		$response = wp_remote_post(
+			'https://api.wordpress.org/plugins/update-check/1.1/',
+			array(
+				'timeout' => 10,
+				'headers' => array(
+					'Content-Type' => 'application/x-www-form-urlencoded',
+					'User-Agent'   => 'WordPress/' . get_bloginfo( 'version' ) . '; ' . home_url( '/' ),
+				),
+				'body'    => $body,
+			)
+		);
+
+		$version = false;
+
+		if ( ! is_wp_error( $response ) ) {
+			$code = wp_remote_retrieve_response_code( $response );
+			$data = json_decode( wp_remote_retrieve_body( $response ), true );
+
+			if ( 200 === (int) $code && ! empty( $data['plugins'][ $plugin_file ]['new_version'] ) ) {
+				$version = $data['plugins'][ $plugin_file ]['new_version'];
+			}
+		}
+
+		if ( $use_cache ) {
+			// Cache the version string, or a "not found" marker so we don't hammer the API on repeated misses.
+			set_transient( $cache_key, false === $version ? '__none__' : $version, $cache_expiry );
+		}
+
+		return $version;
+	}
+
+
 	/**
 	 * Get editor list for post content.
 	 *

classes/WhatsNew.php

@@ -77,15 +77,7 @@ public function whats_new_page() {
 	 * @return array
 	 */
 	private function get_plugin_version_info() {
-		$transient_key = 'tutor_plugin_info';
-		$plugin_info   = get_transient( $transient_key );
-
-		if ( false === $plugin_info ) {
-			$plugin_info = tutils()->get_remote_plugin_info();
-			set_transient( $transient_key, $plugin_info, HOUR_IN_SECONDS );
-		}
-
-		$remote_version    = $plugin_info->version ?? TUTOR_VERSION;
+		$remote_version    = tutils()->get_wp_org_update_version( 'tutor/tutor.php', true, HOUR_IN_SECONDS );
 		$installed_version = TUTOR_VERSION;
 		$update_required   = version_compare( $remote_version, $installed_version, '>' );
 

ecommerce/HooksHandler.php

@@ -405,9 +405,11 @@ public function manage_earnings_and_enrollments( string $order_status, int $orde
 					 */
 					if ( $this->order_model->is_single_order( $order ) ) {
 						update_post_meta( $has_enrollment->ID, EnrollmentModel::ENROLLMENT_ORDER_ID_META, $order_id );
-						$has_bundle_enrollment_meta = get_post_meta( $has_enrollment->ID, CourseBundle::BUNDLE_ENROLLMENT_META, true );
-						if ( $has_bundle_enrollment_meta ) {
-							delete_post_meta( $has_enrollment->ID, CourseBundle::BUNDLE_ENROLLMENT_META );
+						if ( tutor_utils()->is_addon_enabled( 'course-bundle' ) ) {
+							$has_bundle_enrollment_meta = get_post_meta( $has_enrollment->ID, CourseBundle::BUNDLE_ENROLLMENT_META, true );
+							if ( $has_bundle_enrollment_meta ) {
+								delete_post_meta( $has_enrollment->ID, CourseBundle::BUNDLE_ENROLLMENT_META );
+							}
 						}
 						/**
 						 * Update enrollment expiry date if it is set in a course.

models/QuizModel.php

@@ -193,7 +193,11 @@ public static function get_question_types( $type = '' ) {
 	 * @return array
 	 */
 	public static function get_manual_review_types() {
-		return array( 'open_ended', 'short_answer' );
+		return array(
+			self::QUESTION_TYPE_OPEN_ENDED,
+			self::QUESTION_TYPE_SHORT_ANSWER,
+			self::QUESTION_TYPE_IMAGE_ANSWERING,
+		);
 	}