WC_AJAX::update_api_key()
Create/Update API key.
Description Description
Source Source
File: includes/class-wc-ajax.php
public static function update_api_key() {
ob_start();
global $wpdb;
check_ajax_referer( 'update-api-key', 'security' );
if ( ! current_user_can( 'manage_woocommerce' ) ) {
wp_die( -1 );
}
$response = array();
try {
if ( empty( $_POST['description'] ) ) {
throw new Exception( __( 'Description is missing.', 'woocommerce' ) );
}
if ( empty( $_POST['user'] ) ) {
throw new Exception( __( 'User is missing.', 'woocommerce' ) );
}
if ( empty( $_POST['permissions'] ) ) {
throw new Exception( __( 'Permissions is missing.', 'woocommerce' ) );
}
$key_id = isset( $_POST['key_id'] ) ? absint( $_POST['key_id'] ) : 0;
$description = sanitize_text_field( wp_unslash( $_POST['description'] ) );
$permissions = ( in_array( wp_unslash( $_POST['permissions'] ), array( 'read', 'write', 'read_write' ), true ) ) ? sanitize_text_field( wp_unslash( $_POST['permissions'] ) ) : 'read';
$user_id = absint( $_POST['user'] );
// Check if current user can edit other users.
if ( $user_id && ! current_user_can( 'edit_user', $user_id ) ) {
if ( get_current_user_id() !== $user_id ) {
throw new Exception( __( 'You do not have permission to assign API Keys to the selected user.', 'woocommerce' ) );
}
}
if ( 0 < $key_id ) {
$data = array(
'user_id' => $user_id,
'description' => $description,
'permissions' => $permissions,
);
$wpdb->update(
$wpdb->prefix . 'woocommerce_api_keys',
$data,
array( 'key_id' => $key_id ),
array(
'%d',
'%s',
'%s',
),
array( '%d' )
);
$response = $data;
$response['consumer_key'] = '';
$response['consumer_secret'] = '';
$response['message'] = __( 'API Key updated successfully.', 'woocommerce' );
} else {
$consumer_key = 'ck_' . wc_rand_hash();
$consumer_secret = 'cs_' . wc_rand_hash();
$data = array(
'user_id' => $user_id,
'description' => $description,
'permissions' => $permissions,
'consumer_key' => wc_api_hash( $consumer_key ),
'consumer_secret' => $consumer_secret,
'truncated_key' => substr( $consumer_key, -7 ),
);
$wpdb->insert(
$wpdb->prefix . 'woocommerce_api_keys',
$data,
array(
'%d',
'%s',
'%s',
'%s',
'%s',
'%s',
)
);
$key_id = $wpdb->insert_id;
$response = $data;
$response['consumer_key'] = $consumer_key;
$response['consumer_secret'] = $consumer_secret;
$response['message'] = __( 'API Key generated successfully. Make sure to copy your new keys now as the secret key will be hidden once you leave this page.', 'woocommerce' );
$response['revoke_url'] = '<a style="color: #a00; text-decoration: none;" href="' . esc_url( wp_nonce_url( add_query_arg( array( 'revoke-key' => $key_id ), admin_url( 'admin.php?page=wc-settings&tab=advanced§ion=keys' ) ), 'revoke' ) ) . '">' . __( 'Revoke key', 'woocommerce' ) . '</a>';
}
} catch ( Exception $e ) {
wp_send_json_error( array( 'message' => $e->getMessage() ) );
}
// wp_send_json_success must be outside the try block not to break phpunit tests.
wp_send_json_success( $response );
}