Changeset 43067 for branches/4.9/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

Timestamp:

05/01/2018 10:17:26 PM (6 years ago)

Author:

SergeyBiryukov

Message:

REST API: Add who=authors as a query parameter for GET wp/v2/users.

Any WordPress user who can edit_posts of a post type with show_in_rest=true can query for authors. This maps to current WordPress behavior where a WordPress user who can view the Manage Posts view for a post type can see any WordPress user assigned to a post (whether published or draft).

This implementation, over restricting who=authors to users with list_users, gives us future flexibility in displaying lists of posts. It still respects more restrictive permissions for context=edit.

Props danielbachhuber.
Merges [43001] to the 4.9 branch.
Fixes #42202.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (3 diffs)

branches/4.9/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -187 +187 @@
         }
 
+        if ( 'authors' === $request['who'] ) {
+            $can_view = false;
+            $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+            foreach ( $types as $type ) {
+                if ( current_user_can( $type->cap->edit_posts ) ) {
+                    $can_view = true;
+                }
+            }
+            if ( ! $can_view ) {
+                return new WP_Error( 'rest_forbidden_who', __( 'Sorry, you are not allowed to query users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
+            }
+        }
+
         return true;
     }
@@ -251 +264 @@
         }
 
-        if ( ! current_user_can( 'list_users' ) ) {
+        if ( isset( $registered['who'] ) && ! empty( $request['who'] ) && 'authors' === $request['who'] ) {
+            $prepared_args['who'] = 'authors';
+        } elseif ( ! current_user_can( 'list_users' ) ) {
             $prepared_args['has_published_posts'] = get_post_types( array( 'show_in_rest' => true ), 'names' );
         }
@@ -1363 +1378 @@
         );
 
+        $query_params['who'] = array(
+            'description' => __( 'Limit result set to users who are considered authors.' ),
+            'type'        => 'string',
+            'enum'        => array(
+                'authors',
+            ),
+        );
+
         /**
          * Filter collection parameters for the users controller.