Merge pull request #7662 from Automattic/release/4.24.2

Release 4.24.2

changelog.txt

@@ -1,5 +1,24 @@
 *** Changelog ***
 
+## 4.24.2 - 2024-08-08
+### Security
+- Improve email templates security
+
+### Changed
+- Pass `checks` argument to `sensei_can_user_view_lesson` filter [#7657](https://github.com/Automattic/sensei/pull/7657)
+- "Course Started" email is now "Course Enrolled" [#7661](https://github.com/Automattic/sensei/pull/7661)
+
+### Fixed
+- Deprecation notices on PHP 8.2 [#7650](https://github.com/Automattic/sensei/pull/7650)
+- Custom styles for emails in preview and in sent messages [#7595](https://github.com/Automattic/sensei/pull/7595)
+- Keep current status for a question when it is updated [#7603](https://github.com/Automattic/sensei/pull/7603)
+- Prevent lesson loading error in Learning Mode for themes that are using referenced styles [#7658](https://github.com/Automattic/sensei/pull/7658)
+- Remove limit from report export [#7647](https://github.com/Automattic/sensei/pull/7647)
+- Set default names for modules without titles when saving course in the course tour [#7652](https://github.com/Automattic/sensei/pull/7652)
+- Replace "Continue to next lesson" with "Back to lesson" CTA in quiz when lesson is last in course [#7642](https://github.com/Automattic/sensei/pull/7642)
+- Register blocks to make their translations available in the editor [#7643](https://github.com/Automattic/sensei/pull/7643)
+- Tour modal tooltip visibility [#7653](https://github.com/Automattic/sensei/pull/7653)
+
 ## 4.24.1 - 2024-06-13
 ### Security
 - Improve security for lessons and modules ordering

config/psalm/psalm-baseline.xml

@@ -4364,9 +4364,6 @@
     <DocblockTypeContradiction occurrences="1">
       <code>is_wp_error( $result )</code>
     </DocblockTypeContradiction>
-    <InvalidAttribute occurrences="1">
-      <code>\ReturnTypeWillChange</code>
-    </InvalidAttribute>
     <InvalidScalarArgument occurrences="1">
       <code>$timestamp</code>
     </InvalidScalarArgument>
@@ -4380,9 +4377,6 @@
       <code>false</code>
       <code>false</code>
     </FalsableReturnStatement>
-    <InvalidAttribute occurrences="1">
-      <code>\ReturnTypeWillChange</code>
-    </InvalidAttribute>
     <InvalidFalsableReturnType occurrences="1">
       <code>array</code>
     </InvalidFalsableReturnType>
@@ -5380,6 +5374,21 @@
       <code>Sensei_REST_API_Send_Message_Controller</code>
     </PropertyNotSetInConstructor>
   </file>
+  <file src="includes/rest-api/class-sensei-rest-api-sensei-emails-controller.php">
+    <InvalidReturnStatement occurrences="1">
+      <code>$parent_check</code>
+    </InvalidReturnStatement>
+    <InvalidReturnType occurrences="1">
+      <code>true|WP_Error</code>
+    </InvalidReturnType>
+    <PropertyNotSetInConstructor occurrences="5">
+      <code>Sensei_REST_API_Sensei_Emails_Controller</code>
+      <code>Sensei_REST_API_Sensei_Emails_Controller</code>
+      <code>Sensei_REST_API_Sensei_Emails_Controller</code>
+      <code>Sensei_REST_API_Sensei_Emails_Controller</code>
+      <code>Sensei_REST_API_Sensei_Emails_Controller</code>
+    </PropertyNotSetInConstructor>
+  </file>
   <file src="includes/rest-api/class-sensei-rest-api-setup-wizard-controller.php">
     <DeprecatedMethod occurrences="1">
       <code>install_extensions</code>

includes/blocks/class-sensei-block-quiz-question.php

@@ -45,15 +45,15 @@ public function __construct() {
 	/**
 	 * Renders the block as an empty string.
 	 *
-	 * @deprecated $$next-version$$
+	 * @deprecated 4.24.2
 	 *
 	 * @param array  $attributes The block attributes.
 	 * @param string $content    The block content.
 	 *
 	 * @return string The block HTML.
 	 */
 	public function render_quiz_question( array $attributes, string $content ): string { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
-		_deprecated_function( __METHOD__, '$$next-version$$', '__return_empty_string' );
+		_deprecated_function( __METHOD__, '4.24.2', '__return_empty_string' );
 
 		return '';
 	}

includes/internal/emails/class-email-post-type.php

@@ -69,7 +69,7 @@ public function init(): void {
 	 *
 	 * @internal
 	 *
-	 * @since $$next-version$$
+	 * @since 4.24.2
 	 *
 	 * @param array  $editor_settings The editor settings.
 	 * @param object $editor_context  The editor context.
@@ -150,7 +150,7 @@ public function register_post_type(): void {
 		register_post_type(
 			self::POST_TYPE,
 			[
-				'labels'              => [
+				'labels'                => [
 					'name'               => __( 'Emails', 'sensei-lms' ),
 					'singular_name'      => __( 'Email', 'sensei-lms' ),
 					'add_new'            => __( 'Add New', 'sensei-lms' ),
@@ -165,16 +165,17 @@ public function register_post_type(): void {
 					'menu_name'          => __( 'Emails', 'sensei-lms' ),
 					'name_admin_bar'     => __( 'Email', 'sensei-lms' ),
 				],
-				'public'              => true,
-				'exclude_from_search' => true,
-				'publicly_queryable'  => false,
-				'show_in_nav_menus'   => false,
-				'show_ui'             => true,
-				'show_in_menu'        => false,
-				'show_in_rest'        => true, // Enables the Gutenberg editor.
-				'hierarchical'        => false,
-				'rewrite'             => false,
-				'supports'            => [ 'title', 'editor', 'author', 'revisions' ],
+				'public'                => true,
+				'exclude_from_search'   => true,
+				'publicly_queryable'    => false,
+				'show_in_nav_menus'     => false,
+				'show_ui'               => true,
+				'show_in_menu'          => false,
+				'show_in_rest'          => true, // Enables the Gutenberg editor.
+				'hierarchical'          => false,
+				'rewrite'               => false,
+				'supports'              => [ 'title', 'editor', 'author', 'revisions' ],
+				'rest_controller_class' => 'Sensei_REST_API_Sensei_Emails_Controller',
 			]
 		);
 	}

includes/rest-api/class-sensei-rest-api-sensei-emails-controller.php

@@ -0,0 +1,70 @@
+<?php
+/**
+ * Sensei REST API: Sensei_REST_API_Sensei_Emails_Controller class.
+ *
+ * @package sensei-lms
+ * @since   4.24.2
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+/**
+ * A REST controller for Sensei Emails CPT.
+ *
+ * @since 4.24.2
+ *
+ * @see WP_REST_Posts_Controller
+ */
+class Sensei_REST_API_Sensei_Emails_Controller extends WP_REST_Posts_Controller {
+	/**
+	 * Checks if a given request has access to read posts.
+	 *
+	 * @param WP_REST_Request $request Full details about the request.
+	 *
+	 * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
+	 */
+	public function get_items_permissions_check( $request ) {
+		$parent_check = parent::get_items_permissions_check( $request );
+
+		if ( is_wp_error( $parent_check ) ) {
+			return $parent_check;
+		}
+
+		if ( ! current_user_can( 'manage_sensei' ) ) {
+			return new WP_Error(
+				'rest_forbidden_context',
+				__( 'Sorry, you are not allowed to view posts in this post type.', 'sensei-lms' ),
+				array( 'status' => rest_authorization_required_code() )
+			);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Checks if the logged-in user should have access to a specific sensei email.
+	 *
+	 * @param WP_REST_Request $request Full details about the request.
+	 *
+	 * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
+	 */
+	public function get_item_permissions_check( $request ) {
+		$parent_check = parent::get_item_permissions_check( $request );
+
+		if ( is_wp_error( $parent_check ) ) {
+			return $parent_check;
+		}
+
+		if ( ! current_user_can( 'edit_post', $request['id'] ) ) {
+			return new WP_Error(
+				'rest_forbidden_context',
+				__( 'Sorry, you are not allowed to view this item.', 'sensei-lms' ),
+				array( 'status' => rest_authorization_required_code() )
+			);
+		}
+
+		return true;
+	}
+}

includes/sensei-functions.php

@@ -176,7 +176,7 @@ function sensei_can_user_view_lesson( $lesson_id = null, $user_id = null ) {
 	 * Filter if the user can view lesson and quiz content.
 	 *
 	 * @since 1.9.0
-	 * @since $$next-version$$ Added $checks parameter.
+	 * @since 4.24.2 Added $checks parameter.
 	 *
 	 * @hook sensei_can_user_view_lesson
 	 *