Ticket #41445: 41445.2.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -659 +659 @@
                 return $this->add_additional_fields_schema( $this->schema );
         }
 
+        /**
+         * Checks if a given request has access to read an attachment.
+         *
+         * @param WP_REST_Request $request Full details about the request.
+         * @return bool|WP_Error True if the request has read access for the item, WP_Error object otherwise.
+         */
+        public function get_item_permissions_check( $request ) {
+                $query_args = array(
+                        'post_status' => 'any',
+                        'post_type' => 'any',
+                        'meta_key'   => '_thumbnail_id',
+                        'meta_value' => $request['id'],
+                        'no_found_rows' => true,
+                        'posts_per_page' => 100, // Set a reasonable maximum number of results.
+                );
+
+                $posts_query  = new WP_Query();
+                $query_result = $posts_query->query( $query_args );
+
+                $wp_error = false;
+
+                foreach ( $query_result as $post ) {
+
+                        if ( is_wp_error( $post ) ) {
+                                continue;
+                        }
+
+
+                        if ( 'edit' === $request['context'] && $post && ! $this->check_update_permission( $post ) ) {
+                                $wp_error = WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit this post.' ), array( 'status' => rest_authorization_required_code() ) );
+                        }
+
+                        if ( $post && ! empty( $request['password'] ) ) {
+                                // Check post password, and return error if invalid.
+                                if ( ! hash_equals( $post->post_password, $request['password'] ) ) {
+                                        $wp_error = WP_Error( 'rest_post_incorrect_password', __( 'Incorrect post password.' ), array( 'status' => 403 ) );
+                                }
+                        }
+
+                        // Allow access to all password protected posts if the context is edit.
+                        if ( 'edit' === $request['context'] ) {
+                                add_filter( 'post_password_required', '__return_false' );
+                        }
+
+                        if ( $post && $this->check_read_permission( $post ) ) {
+                                return true;
+                        }
+                }
+
+                if( $wp_error && ! $has_permission ) {
+                        return $wp_error;
+                }
+
+                return parent::get_item_permissions_check( $request );
+        }
+
         /**
          * Handles an upload via raw POST data.
          *