REST API: Design settings fatal and category image/icon writes are silently ignored

[markbekhit]

Environment

• GeoDirectory 2.8.164 (also reproduced by source inspection in 2.8.167)
• WordPress 6.9.4
• PHP 8.3
• Authenticated WordPress REST API request using an application password

These appear to be core REST controller defects rather than a plugin/theme conflict. I reproduced both on a live site and confirmed the affected source is unchanged in 2.8.167.

1. GET /wp-json/geodir/v2/settings/design fatals

Authenticated request:

GET /wp-json/geodir/v2/settings/design
Authorization: Basic ...

Result: HTTP 500.

Exact exception:

Error: Call to undefined function get_page_templates()
at includes/admin/settings/class-geodir-settings-design.php:494

The call originates from GeoDir_Settings_Design::single_page_templates(), reached through GeoDir_Settings_Design::get_settings() and GeoDir_Register_WP_Admin_Settings::register_page_settings().

get_page_templates() is defined in WordPress's admin theme include, which is not loaded in this REST request context. The endpoint succeeds if ABSPATH . 'wp-admin/includes/theme.php' is required before the callback.

Suggested fix: load the WordPress theme helper before using get_page_templates() (or use an API available in REST context).

2. Category image / icon writes return 200 but do nothing

The REST index advertises image and icon object fields for:

POST|PUT|PATCH /wp-json/geodir/v2/places/categories/{id}

Minimal request:

PATCH /wp-json/geodir/v2/places/categories/437
Content-Type: application/json

{"image":{"id":1830},"icon":{"id":1830}}

Result: HTTP 200, but the response omits the category media fields and a fresh GET shows that the image/icon values were not persisted.

GeoDir_REST_Post_Categories_Controller adds these fields to its response/schema but does not implement update handling. It inherits the core WP_REST_Terms_Controller update path, which only processes standard term fields and registered term meta; the custom objects are silently ignored.

GeoDirectory stores the values in ct_cat_default_img and ct_cat_icon term meta as an object containing the attachment ID and relative source URL.

Suggested fix: add explicit create/update handling for both fields, validate that non-zero IDs are image attachments, permit ID 0 to clear a field, update the relevant term meta, clear term/icon caches, and return the refreshed category representation. Invalid input should be validated before either field is changed so a combined request remains atomic.

Expected behaviour

• The Design settings endpoint returns its settings array without a fatal.
• Valid category image/icon IDs persist and appear on a fresh GET.
• ID 0 clears the requested field.
• Invalid attachment IDs return a 4xx error without partially applying another field from the same request.