Changeset 58227 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php

Timestamp:

05/29/2024 07:19:56 AM (6 months ago)

Author:

youknowriad

Message:

REST API: Allow view access of template endpoint to anyone with the edit_post capability.

In order to render the block template in the locked template preview inside the post editor we need to be able to fetch the contents of any block templates/template parts for any user role that can edit a post.

Props fabiankaegy, youknowriad.
Fixes #61137.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php (modified) (4 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php

@@ -237 +237 @@
      *
      * @since 5.8.0
+     * @since 6.6.0 Allow users with edit_posts capability to read templates.
      *
      * @param WP_REST_Request $request Full details about the request.
@@ -242 +243 @@
      */
     public function get_items_permissions_check( $request ) {
-        return $this->permissions_check( $request );
+        if ( current_user_can( 'edit_posts' ) ) {
+            return true;
+        }
+        foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+            if ( current_user_can( $post_type->cap->edit_posts ) ) {
+                return true;
+            }
+        }
+
+        return new WP_Error(
+            'rest_cannot_manage_templates',
+            __( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+            array(
+                'status' => rest_authorization_required_code(),
+            )
+        );
     }
 
@@ -278 +294 @@
      *
      * @since 5.8.0
+     * @since 6.6.0 Allow users with edit_posts capability to read individual templates.
      *
      * @param WP_REST_Request $request Full details about the request.
@@ -283 +300 @@
      */
     public function get_item_permissions_check( $request ) {
-        return $this->permissions_check( $request );
+        if ( current_user_can( 'edit_posts' ) ) {
+            return true;
+        }
+        foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+            if ( current_user_can( $post_type->cap->edit_posts ) ) {
+                return true;
+            }
+        }
+
+        return new WP_Error(
+            'rest_cannot_manage_templates',
+            __( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+            array(
+                'status' => rest_authorization_required_code(),
+            )
+        );
     }