Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-23 01:27:36 +01:00
Code Issues Projects Releases Wiki Activity

REST API: Allow view access of template endpoint to anyone with the edit_post capability.

Browse Source 
In order to render the block template in the locked template preview inside the post editor we need to be able to fetch the contents of any block templates/template parts for any user role that can edit a post.

Props fabiankaegy, youknowriad.
Fixes #61137.
Built from https://develop.svn.wordpress.org/trunk@58227


git-svn-id: http://core.svn.wordpress.org/trunk@57690 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
youknowriad 2024-05-29 07:21:16 +00:00
parent 0bf7df15f3
commit 780d126082
2 changed files with 35 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php
View File

@ -236,12 +236,28 @@ class WP_REST_Templates_Controller extends WP_REST_Controller {
* Checks if a given request has access to read templates.
*
* @since 5.8.0
* @since 6.6.0 Allow users with edit_posts capability to read templates.
*
* @param WP_REST_Request $request Full details about the request.
* @return true|WP_Error True if the request has read access, WP_Error object otherwise.
*/
public function get_items_permissions_check( $request ) {
return $this->permissions_check( $request );
if ( current_user_can( 'edit_posts' ) ) {
return true;
}
foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
if ( current_user_can( $post_type->cap->edit_posts ) ) {
return true;
}
}
return new WP_Error(
'rest_cannot_manage_templates',
__( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
array(
'status' => rest_authorization_required_code(),
)
);
}
/**
@ -277,12 +293,28 @@ class WP_REST_Templates_Controller extends WP_REST_Controller {
* Checks if a given request has access to read a single template.
*
* @since 5.8.0
* @since 6.6.0 Allow users with edit_posts capability to read individual templates.
*
* @param WP_REST_Request $request Full details about the request.
* @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise.
*/
public function get_item_permissions_check( $request ) {
return $this->permissions_check( $request );
if ( current_user_can( 'edit_posts' ) ) {
return true;
}
foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
if ( current_user_can( $post_type->cap->edit_posts ) ) {
return true;
}
}
return new WP_Error(
'rest_cannot_manage_templates',
__( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
array(
'status' => rest_authorization_required_code(),
)
);
}
/**

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.6-alpha-58226';
$wp_version = '6.6-alpha-58227';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.