Changeset 43001 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

Timestamp:

04/25/2018 01:05:48 PM (8 years ago)

Author:

pento

Message:

REST API: Add who=authors as a query parameter for GET wp/v2/users.

Any WordPress user who can edit_posts of a post type with show_in_rest=true can query for authors. This maps to current WordPress behavior where a WordPress user who can view the Manage Posts view for a post type can see any WordPress user assigned to a post (whether published or draft).

This implementation, over restricting who=authors to users with list_users, gives us future flexibility in displaying lists of posts. It still respects more restrictive permissions for context=edit.

Props danielbachhuber.
Fixes #42202.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (3 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -193 +193 @@
                 }
 
+                if ( 'authors' === $request['who'] ) {
+                        $can_view = false;
+                        $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+                        foreach ( $types as $type ) {
+                                if ( current_user_can( $type->cap->edit_posts ) ) {
+                                        $can_view = true;
+                                }
+                        }
+                        if ( ! $can_view ) {
+                                return new WP_Error( 'rest_forbidden_who', __( 'Sorry, you are not allowed to query users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
+                        }
+                }
+
                 return true;
         }
@@ -257 +270 @@
                 }
 
-                if ( ! current_user_can( 'list_users' ) ) {
+                if ( isset( $registered['who'] ) && ! empty( $request['who'] ) && 'authors' === $request['who'] ) {
+                        $prepared_args['who'] = 'authors';
+                } elseif ( ! current_user_can( 'list_users' ) ) {
                         $prepared_args['has_published_posts'] = get_post_types( array( 'show_in_rest' => true ), 'names' );
                 }
@@ -1373 +1388 @@
                 );
 
+                $query_params['who'] = array(
+                        'description' => __( 'Limit result set to users who are considered authors.' ),
+                        'type'        => 'string',
+                        'enum'        => array(
+                                'authors',
+                        ),
+                );
+
                 /**
                  * Filter collection parameters for the users controller.