Changeset 52342 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php

Timestamp:

12/07/2021 08:56:18 PM (3 years ago)

Author:

spacedmonkey

Message:

REST API: Improve permission handling in global style endpoint.

The new wp_global_styles post type is registered to use edit_theme_options in the capability settings. The WP_REST_Global_Styles_Controller class's permission checks methods use the capability in a hard coded form rather than looking up the capability via the post type object. Changing the permission callbacks to lookup capabilities via the post type object, allows theme and plugin developers to modify the capability used for editing global styles via a filter and these values to be respected via the Global Styles REST API.

Props Spacedmonkey, peterwilsoncc, hellofromTonya , antonvlasenko, TimothyBlynJacobs, costdev, zieladam.
Fixes #54516.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php (modified) (10 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php

@@ -12 +12 @@
  */
 class WP_REST_Global_Styles_Controller extends WP_REST_Controller {
+
+    /**
+     * Post type.
+     *
+     * @since 5.9.0
+     * @var string
+     */
+    protected $post_type;
+
     /**
      * Constructor.
@@ -19 +28 @@
         $this->namespace = 'wp/v2';
         $this->rest_base = 'global-styles';
+        $this->post_type = 'wp_global_styles';
     }
 
@@ -76 +86 @@
 
     /**
-     * Checks if the user has permissions to make the request.
-     *
-     * @since 5.9.0
-     *
+     * Checks if a given request has access to read a single global style.
+     *
+     * @since 5.9.0
+     *
+     * @param WP_REST_Request $request Full details about the request.
      * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
      */
-    protected function permissions_check() {
-        // Verify if the current user has edit_theme_options capability.
-        // This capability is required to edit/view/delete templates.
-        if ( ! current_user_can( 'edit_theme_options' ) ) {
+    public function get_item_permissions_check( $request ) {
+        $post = $this->get_post( $request['id'] );
+        if ( is_wp_error( $post ) ) {
+            return $post;
+        }
+
+        if ( 'edit' === $request['context'] && $post && ! $this->check_update_permission( $post ) ) {
             return new WP_Error(
-                'rest_cannot_manage_global_styles',
-                __( 'Sorry, you are not allowed to access the global styles on this site.' ),
-                array(
-                    'status' => rest_authorization_required_code(),
-                )
+                'rest_forbidden_context',
+                __( 'Sorry, you are not allowed to edit this global style.' ),
+                array( 'status' => rest_authorization_required_code() )
             );
         }
 
+        if ( ! $this->check_read_permission( $post ) ) {
+            return new WP_Error(
+                'rest_cannot_view',
+                __( 'Sorry, you are not allowed to view this global style.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
         return true;
     }
 
     /**
-     * Checks if a given request has access to read a single global styles config.
-     *
-     * @param WP_REST_Request $request Full details about the request.
-     * @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise.
-     */
-    public function get_item_permissions_check( $request ) {
-        return $this->permissions_check( $request );
+     * Checks if a global style can be read.
+     *
+     * @since 5.9.0
+     *
+     * @param WP_Post $post Post object.
+     * @return bool Whether the post can be read.
+     */
+    protected function check_read_permission( $post ) {
+        return current_user_can( 'read_post', $post->ID );
     }
 
@@ -118 +140 @@
      */
     public function get_item( $request ) {
-        $post = get_post( $request['id'] );
-        if ( ! $post || 'wp_global_styles' !== $post->post_type ) {
-            return new WP_Error( 'rest_global_styles_not_found', __( 'No global styles config exist with that id.' ), array( 'status' => 404 ) );
+        $post = $this->get_post( $request['id'] );
+        if ( is_wp_error( $post ) ) {
+            return $post;
         }
 
@@ -135 +157 @@
      */
     public function update_item_permissions_check( $request ) {
-        return $this->permissions_check( $request );
+        $post = $this->get_post( $request['id'] );
+        if ( is_wp_error( $post ) ) {
+            return $post;
+        }
+
+        if ( $post && ! $this->check_update_permission( $post ) ) {
+            return new WP_Error(
+                'rest_cannot_edit',
+                __( 'Sorry, you are not allowed to edit this global style.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
+    }
+
+    /**
+     * Checks if a global style can be edited.
+     *
+     * @since 5.9.0
+     *
+     * @param WP_Post $post Post object.
+     * @return bool Whether the post can be edited.
+     */
+    protected function check_update_permission( $post ) {
+        return current_user_can( 'edit_post', $post->ID );
     }
 
@@ -147 +194 @@
      */
     public function update_item( $request ) {
-        $post_before = get_post( $request['id'] );
-        if ( ! $post_before || 'wp_global_styles' !== $post_before->post_type ) {
-            return new WP_Error( 'rest_global_styles_not_found', __( 'No global styles config exist with that id.' ), array( 'status' => 404 ) );
+        $post_before = $this->get_post( $request['id'] );
+        if ( is_wp_error( $post_before ) ) {
+            return $post_before;
         }
 
@@ -290 +337 @@
     }
 
+    /**
+     * Get the post, if the ID is valid.
+     *
+     * @since 5.9.0
+     *
+     * @param int $id Supplied ID.
+     * @return WP_Post|WP_Error Post object if ID is valid, WP_Error otherwise.
+     */
+    protected function get_post( $id ) {
+        $error = new WP_Error(
+            'rest_global_styles_not_found',
+            __( 'No global styles config exist with that id.' ),
+            array( 'status' => 404 )
+        );
+
+        $id = (int) $id;
+        if ( $id <= 0 ) {
+            return $error;
+        }
+
+        $post = get_post( $id );
+        if ( empty( $post ) || empty( $post->ID ) || $this->post_type !== $post->post_type ) {
+            return $error;
+        }
+
+        return $post;
+    }
+
 
     /**
@@ -324 +399 @@
         $rels = array();
 
-        $post_type = get_post_type_object( 'wp_global_styles' );
+        $post_type = get_post_type_object( $this->post_type );
         if ( current_user_can( $post_type->cap->publish_posts ) ) {
             $rels[] = 'https://api.w.org/action-publish';
@@ -372 +447 @@
         $schema = array(
             '$schema'    => 'http://json-schema.org/draft-04/schema#',
-            'title'      => 'wp_global_styles',
+            'title'      => $this->post_type,
             'type'       => 'object',
             'properties' => array(
@@ -427 +502 @@
      */
     public function get_theme_item_permissions_check( $request ) {
-        return $this->permissions_check( $request );
+        // Verify if the current user has edit_theme_options capability.
+        // This capability is required to edit/view/delete templates.
+        if ( ! current_user_can( 'edit_theme_options' ) ) {
+            return new WP_Error(
+                'rest_cannot_manage_global_styles',
+                __( 'Sorry, you are not allowed to access the global styles on this site.' ),
+                array(
+                    'status' => rest_authorization_required_code(),
+                )
+            );
+        }
+
+        return true;
     }