Changeset 59718 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-menu-items-controller.php

Timestamp:

01/28/2025 04:07:07 AM (6 months ago)

Author:

spacedmonkey

Message:

REST API: Introduce filter for controlling menu read access.

The menu, menu item, and menu location endpoints were added to the REST API in [52079]. In that commit, menu data was treated as private and restricted to logged-in users with the edit_theme_options capability. However, in many cases, this data can be considered public. Previously, there was no simple way for developers to allow this data to be exposed via the REST API.

This commit introduces the rest_menu_read_access filter, enabling developers to control read access to menus, menu items, and menu locations in the REST API. The same filter is applied across all three REST API classes, simplifying the process of opting into exposing this data.

Each instance of the filter provides the current request and the relevant class instance as context, allowing developers to selectively or globally enable access to the data.

Props spacedmonkey, antonvlasenko, kadamwhite, julianmar, masteradhoc.
Fixes #54304.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-menu-items-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-menu-items-controller.php

@@ -81 +81 @@
      */
     protected function check_has_read_only_access( $request ) {
+        /**
+         * Filters whether the current user has read access to menu items via the REST API.
+         *
+         * @since 6.8.0
+         * @param $read_only_access bool Whether the current user has read access to menu items via the REST API.
+         * @param $request WP_REST_Request Full details about the request.
+         * @param $this WP_REST_Controller The current instance of the controller.
+         */
+        $read_only_access = apply_filters( 'rest_menu_read_access', false, $request, $this );
+        if ( $read_only_access ) {
+            return true;
+        }
+
         if ( current_user_can( 'edit_theme_options' ) ) {
             return true;