wp.getOptions do'nt have a capability check

[nprasath002]

This won't be a big problem with default options.
If the blog options are extended via a plugin this would be a problem.
Better to have a check,

[ericmann]

Considering the default behavior of the options page in WordPress is to check the same permission, I agree.

Updating patch to reference the patched file.

[ericmann]

Updated patch file to reference the file it's patching.

[ericmann]

Actually, after putting some thought into this, we shouldn't restrict options checking with a capability check. That would disallow remote applications from getting any options values unless the user had permission to manage options.

Think about how many times a site calls get_option() for unauthenticated users or for authors without options management privileges. wp.getOptions serves a similar purpose for remote apps; a capability check here isn't really appropriate.

[nacin]

Correct - a cap check is inappropriate here.