REST API: Capability check for creating terms differs from wp-admin

[johnbillion]

The capability check used in WP_REST_Terms_Controller when attempting to create a new term is manage_terms, but it should be edit_terms.

Refs:

• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/edit-tags.php?rev=39308&marks=74#L70
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/edit-tags.php?rev=39308&marks=322#L320

In #33975 we'll hopefully change this to create_terms.

[rmccue]

It appears the capability is actually both manage_terms and edit_terms in the admin; edit-tags.php has an earlier check for manage_terms.

XML-RPC was updated in [38698], see also #35614; makes sense to update to match the new caps.

Patch looks good. WP_REST_Taxonomies_Controller still contains 3 instances of manage_terms, but seems like those uses haven't changed?

[rachelbaker]

38958.diff​ Approved for commit (Ryan already added the commit keyword).

[SergeyBiryukov]

It would be great to document the difference (if there is any) between edit_terms and manage_terms at some point, they appear to be used somewhat interchangeably in core.

I could not find any documentation at the moment (as mentioned in comment:6:ticket:38857).

[rachelbaker]

In 39402:

REST API: Fix incorrect capability check on term create.

Change the capability check used in WP_REST_Terms_Controller when creating a new term is attempted, from manage_terms to edit_terms. This matches the behavior within the WordPress admin. See #35614.

Props johnbillion, rmccue, rachelbaker, helen, jorbin, SergeyBiryukov.

Fixes #38958.

[rachelbaker]

Replying to SergeyBiryukov:

It would be great to document the difference (if there is any) between edit_terms and manage_terms at some point, they appear to be used somewhat interchangeably in core.

I could not find any documentation at the moment (as mentioned in comment:6:ticket:38857).

Makes sense, I know I am not 100% clear on the intended difference. I was also not clear on the next action or directed target of your comment (perhaps @johnbillion ?), but I did not interpret it is a blocker for commit. Please let me know if I assumed incorrectly.

[rachelbaker]

In 39403:

REST API: Fix incorrect capability check on term create.

Change the capability check used in WP_REST_Terms_Controller when creating a new term is attempted, from manage_terms to edit_terms. This matches the behavior within the WordPress admin. See #35614.

Props johnbillion, rmccue, rachelbaker, helen, jorbin, SergeyBiryukov.

Merges [39402] to the 4.7 branch.
Fixes #38958 for 4.7.