Changeset 47034

Timestamp:

01/03/2020 02:26:36 AM (7 years ago)

Author:

SergeyBiryukov

Message:

REST API: Synchronize permission checks in ::get_items_permissions_check() methods for post types, post statuses, and users:

• Only query post types with 'show_in_rest' => true instead of looping over all post types and checking the show_in_rest property separately.
• Return from the foreach() loop as soon as the permission check succeeded.

Props pbiron, TimothyBlynJacobs, SergeyBiryukov.
Fixes #49118.

Location:

trunk/src/wp-includes/rest-api/endpoints

Files:

• class-wp-rest-post-statuses-controller.php (modified) (1 diff)
• class-wp-rest-post-types-controller.php (modified) (2 diffs)
• class-wp-rest-users-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-post-statuses-controller.php

@@ -90 +90 @@
                                 }
                         }
+
                         return new WP_Error( 'rest_cannot_view', __( 'Sorry, you are not allowed to manage post statuses.' ), array( 'status' => rest_authorization_required_code() ) );
                 }

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-post-types-controller.php

@@ -82 +82 @@
         public function get_items_permissions_check( $request ) {
                 if ( 'edit' === $request['context'] ) {
-                        foreach ( get_post_types( array(), 'object' ) as $post_type ) {
-                                if ( ! empty( $post_type->show_in_rest ) && current_user_can( $post_type->cap->edit_posts ) ) {
+                        $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+
+                        foreach ( $types as $type ) {
+                                if ( current_user_can( $type->cap->edit_posts ) ) {
                                         return true;
                                 }
@@ -103 +105 @@
          */
         public function get_items( $request ) {
-                $data = array();
-
-                foreach ( get_post_types( array(), 'object' ) as $obj ) {
-                        if ( empty( $obj->show_in_rest ) || ( 'edit' === $request['context'] && ! current_user_can( $obj->cap->edit_posts ) ) ) {
+                $data  = array();
+                $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+
+                foreach ( $types as $type ) {
+                        if ( 'edit' === $request['context'] && ! current_user_can( $type->cap->edit_posts ) ) {
                                 continue;
                         }
 
-                        $post_type          = $this->prepare_item_for_response( $obj, $request );
-                        $data[ $obj->name ] = $this->prepare_response_for_collection( $post_type );
+                        $post_type           = $this->prepare_item_for_response( $type, $request );
+                        $data[ $type->name ] = $this->prepare_response_for_collection( $post_type );
                 }
 

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -200 +200 @@
 
                 if ( 'authors' === $request['who'] ) {
-                        $can_view = false;
-                        $types    = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+                        $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+
                         foreach ( $types as $type ) {
                                 if ( post_type_supports( $type->name, 'author' )
                                         && current_user_can( $type->cap->edit_posts ) ) {
-                                        $can_view = true;
+                                        return true;
                                 }
                         }
-                        if ( ! $can_view ) {
-                                return new WP_Error( 'rest_forbidden_who', __( 'Sorry, you are not allowed to query users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
-                        }
+
+                        return new WP_Error( 'rest_forbidden_who', __( 'Sorry, you are not allowed to query users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
                 }