Ticket #48764: class-wp-rest-posts-controller.php.patch

class-wp-rest-posts-controller.php

@@ -1009 +1009 @@
 
                // Post status.
                if ( ! empty( $schema['properties']['status'] ) && isset( $request['status'] ) ) {
-                       $status = $this->handle_status_param( $request['status'], $post_type );
+                       $status = $this->handle_status_param( $request['status'], $post_type, $request['id'] );
 
                        if ( is_wp_error( $status ) ) {
                                return $status;
@@ -1145 +1145 @@
         * @param object $post_type   Post type.
         * @return string|WP_Error Post status or WP_Error if lacking the proper permission.
         */
-       protected function handle_status_param( $post_status, $post_type ) {
+       protected function handle_status_param( $post_status, $post_type, $ID ) {
 
                switch ( $post_status ) {
                        case 'draft':
                        case 'pending':
                                break;
                        case 'private':
-                               if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
+                               if ( ! current_user_can( $post_type->cap->publish_posts, $ID ) ) {
                                        return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create private posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );
                                }
                                break;
                        case 'publish':
                        case 'future':
-                               if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
+                               if ( ! current_user_can( $post_type->cap->publish_posts, $ID ) ) {
                                        return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to publish posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );
                                }
                                break;