Changeset 63526 for trunk/src/wp-includes/rest-api.php

Timestamp:

09/08/2026 08:41:22 AM (15 hours ago)

Author:

oandregal

Message:

REST API: expose privacy policy page in settings endpoint.

Props oandregal, ntsekouras, joen.
Fixes #66045.

File:

• trunk/src/wp-includes/rest-api.php (modified) (1 diff)

trunk/src/wp-includes/rest-api.php

@@ -3448 +3448 @@
 }
 
+/**
+ * Prevents users without the `manage_privacy_options` capability from
+ * changing the privacy policy page through the REST API.
+ *
+ * The settings endpoint only checks `manage_options`. On multisite the
+ * `manage_privacy_options` capability maps to `manage_network`, so a site
+ * administrator can read the setting but must not change it, matching the
+ * Settings > Privacy screen.
+ *
+ * @since 7.2.0
+ *
+ * @param bool   $updated Whether the setting update has already been handled.
+ * @param string $name    Setting name (as shown in REST API responses).
+ * @return bool Whether to short-circuit the update.
+ */
+function rest_restrict_privacy_policy_page_setting_update( $updated, $name ) {
+        if ( 'page_for_privacy_policy' === $name && ! current_user_can( 'manage_privacy_options' ) ) {
+                return true;
+        }
+        return $updated;
+}
 
 /**