wordpress-turnstile

class-field-manager.php (6388B)

---

 <?php
 /**
  * Field Manager
  *
  * Manages the price category meta fields on post types.
  */
 
 if (!defined('ABSPATH')) {
     exit;
 }
 
 class Taler_Field_Manager {
 
     /**
      * Add price category fields to specified post types
      *
      * @param array $post_types Array of post type names
      */
     public static function add_fields_to_post_types($post_types) {
         foreach ($post_types as $post_type) {
             // Verify post type exists
             if (!post_type_exists($post_type)) {
                 continue;
             }
 
             self::add_price_category_field($post_type);
         }
     }
 
     /**
      * Add price category field to a specific post type
      *
      * @param string $post_type The post type name
      */
     protected static function add_price_category_field($post_type) {
         // Register the meta box for this post type
         add_action('add_meta_boxes', function() use ($post_type) {
             add_meta_box(
                 'taler_turnstile_price_category',
                 __('Taler Turnstile Price Category', 'taler-turnstile'),
                 array('Taler_Field_Manager', 'render_price_category_meta_box'),
                 $post_type,
                 'side',
                 'default'
             );
         });
 
         // Register the meta field
         register_post_meta($post_type, '_taler_price_category', array(
             'type' => 'string',
             'description' => __('Selected price category for this content', 'taler-turnstile'),
             'single' => true,
             'show_in_rest' => true,
             'sanitize_callback' => 'sanitize_key',
             'auth_callback' => function() {
                 return current_user_can('edit_posts');
             }
         ));
 
         // Save the meta field
         add_action('save_post_' . $post_type, array('Taler_Field_Manager', 'save_price_category_meta'), 10, 2);
     }
 
     /**
      * Render the price category meta box
      *
      * @param WP_Post $post The post object
      */
     public static function render_price_category_meta_box($post) {
         wp_nonce_field('taler_price_category_meta', 'taler_price_category_nonce');
 
         $selected_category = get_post_meta($post->ID, '_taler_price_category', true);
         $categories = Taler_Price_Category::get_all();
         ?>
         <p>
             <label for="taler_price_category">
                 <?php esc_html_e('Price Category:', 'taler-turnstile'); ?>
             </label>
             <select name="taler_price_category" id="taler_price_category" style="width: 100%;">
                 <option value=""><?php esc_html_e('-- None --', 'taler-turnstile'); ?></option>
                 <?php foreach ($categories as $id => $category): ?>
                     <option value="<?php echo esc_attr($id); ?>" <?php selected($selected_category, $id); ?>>
                         <?php echo esc_html($category['label']); ?>
                     </option>
                 <?php endforeach; ?>
             </select>
         </p>
         <p class="description">
             <?php esc_html_e('Select a price category for this content. Leave empty for free access.', 'taler-turnstile'); ?>
         </p>
         <?php
     }
 
     /**
      * Save the price category meta field
      *
      * @param int $post_id The post ID
      * @param WP_Post $post The post object
      */
     public static function save_price_category_meta($post_id, $post) {
         // Check nonce
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
         // FIXME: reviewers say sanitization is needed here for wp_verify_nonce()
         // But https://wordpress.stackexchange.com/questions/256513/should-nonce-be-sanitized
         // says this is not needed and points to
         // https://github.com/WordPress/wordpress-develop/blob/6.2/src/wp-includes/pluggable.php#L1271
         // for an example where the wordpress core also does not do it.
         // I truly do not see why the reviewers believe sanitization is useful here.
         if (!isset($_POST['taler_price_category_nonce']) ||
             !wp_verify_nonce($_POST['taler_price_category_nonce'], 'taler_price_category_meta')) {
             return;
         }
 
         // Check autosave
         if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
             return;
         }
 
         // Check permissions
         if (!current_user_can('edit_post', $post_id)) {
             return;
         }
 
         // Save or delete the meta field
         if (isset($_POST['taler_price_category'])) {
             $category = sanitize_key($_POST['taler_price_category']);
 
             if (empty($category)) {
                 delete_post_meta($post_id, '_taler_price_category');
             } else {
                 update_post_meta($post_id, '_taler_price_category', $category);
             }
         }
     }
 
     /**
      * Remove price category fields from specified post types
      *
      * @param array $post_types Array of post type names
      */
     public static function remove_fields_from_post_types($post_types) {
         foreach ($post_types as $post_type) {
             self::remove_price_category_field($post_type);
         }
     }
 
     /**
      * Remove price category field from a specific post type
      *
      * @param string $post_type The post type name
      */
     protected static function remove_price_category_field($post_type) {
         // Unregister the meta field
         unregister_post_meta($post_type, '_taler_price_category');
 
         // Note: Meta boxes are removed automatically when not registered
         // We don't need to explicitly remove them since they're added via hooks
     }
 
     /**
      * Cleanup all price category meta when no post types are using it
      */
     public static function cleanup_field_storage() {
         global $wpdb;
 
         // Delete all price category meta from all posts
         $wpdb->delete(
             $wpdb->postmeta,
             array('meta_key' => '_taler_price_category'),
             array('%s')
         );
     }
 
     /**
      * Initialize field manager hooks
      */
     public static function init() {
         $enabled_types = get_option('taler_turnstile_enabled_post_types', array('post'));
 
         if (!empty($enabled_types)) {
             self::add_fields_to_post_types($enabled_types);
         }
     }
 }