Changeset 60817 for branches/6.8/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

Timestamp:

09/30/2025 04:50:20 PM (11 months ago)

Author:

johnbillion

Message:

REST API: Increase the specificity of capability checks for collections when the edit context is in use.

The edit access in now taken into account for each individual post, term, or user in the response.

Merges [60814] into the 6.8 branch.

Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, rmccue, timothyblynjacobs, vortfu, whyisjake, zieladam.

Location:

branches/6.8

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (1 diff)

branches/6.8/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -464 +464 @@
 
                         foreach ( $query_result as $post ) {
-                                if ( ! $this->check_read_permission( $post ) ) {
+                                if ( 'edit' === $request['context'] ) {
+                                        $permission = $this->check_update_permission( $post );
+                                } else {
+                                        $permission = $this->check_read_permission( $post );
+                                }
+
+                                if ( ! $permission ) {
                                         continue;
                                 }