Changeset 47034 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

Timestamp:

01/03/2020 02:26:36 AM (5 years ago)

Author:

SergeyBiryukov

Message:

REST API: Synchronize permission checks in ::get_items_permissions_check() methods for post types, post statuses, and users:

• Only query post types with 'show_in_rest' => true instead of looping over all post types and checking the show_in_rest property separately.
• Return from the foreach() loop as soon as the permission check succeeded.

Props pbiron, TimothyBlynJacobs, SergeyBiryukov.
Fixes #49118.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -200 +200 @@
 
         if ( 'authors' === $request['who'] ) {
-            $can_view = false;
-            $types    = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+            $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
+
             foreach ( $types as $type ) {
                 if ( post_type_supports( $type->name, 'author' )
                     && current_user_can( $type->cap->edit_posts ) ) {
-                    $can_view = true;
+                    return true;
                 }
             }
-            if ( ! $can_view ) {
-                return new WP_Error( 'rest_forbidden_who', __( 'Sorry, you are not allowed to query users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
-            }
+
+            return new WP_Error( 'rest_forbidden_who', __( 'Sorry, you are not allowed to query users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
         }