REST API: Post status controller has wrong view permission check error message

[schlessera]

The REST API post status controller has the following code to make a read-only permissions check for viewing the post statuses:

<?php
if ( 'edit' === $request['context'] ) {
   $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );

   foreach ( $types as $type ) {
      if ( current_user_can( $type->cap->edit_posts ) ) {
         return true;
      }
   }
   return new WP_Error( 'rest_cannot_view', __( 'Sorry, you are not allowed to edit posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );
}

This seems to be left-over copy-pasta from the post types controller.

I'd suggest sending the following WP_Error message instead:

__( 'Sorry, you are not allowed to manage post statuses.' )

[schlessera]

'Sorry, you are not allowed to manage post statuses.'

[schlessera]

Replying to schlessera:
Oh, sorry, I seemed to have edited out the actual problem in my description: The error message does not match the intent of the controller.

[joehoyle]

In 42356:

REST API: Fix permissions error message in post statuses controller.

The permissions error message when a request tries to fetch post statuses unauthenticated is incorrect. It was a copy/paste from elsewhere, as indicated by the use of "in this post type" where this is no post type referenced.

Props schlessera.
Fixes #42303.

[SergeyBiryukov]

[42356] should be backported to the 5.0 branch.

[danielbachhuber]

In 43755:

REST API: Fix permissions error message in post statuses controller.

The permissions error message when a request tries to fetch post statuses unauthenticated is incorrect. It was a copy/paste from elsewhere, as indicated by the use of "in this post type" where this is no post type referenced.

Props schlessera.
Merges [42356] to the 5.0 branch.
Fixes #42303.