Changeset 58227

Timestamp:

05/29/2024 07:19:56 AM (2 months ago)

Author:

youknowriad

Message:

REST API: Allow view access of template endpoint to anyone with the edit_post capability.

In order to render the block template in the locked template preview inside the post editor we need to be able to fetch the contents of any block templates/template parts for any user role that can edit a post.

Props fabiankaegy, youknowriad.
Fixes #61137.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php (modified) (4 diffs)
• tests/phpunit/tests/rest-api/wpRestTemplatesController.php (modified) (4 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php

@@ -237 +237 @@
      *
      * @since 5.8.0
+
      *
      * @param WP_REST_Request $request Full details about the request.
@@ -242 +243 @@
      */
     public function get_items_permissions_check( $request ) {
-        return $this->permissions_check( $request );
+        if ( current_user_can( 'edit_posts' ) ) {
+            return true;
+        }
+        foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+            if ( current_user_can( $post_type->cap->edit_posts ) ) {
+                return true;
+            }
+        }
+
+        return new WP_Error(
+            'rest_cannot_manage_templates',
+            __( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+            array(
+                'status' => rest_authorization_required_code(),
+            )
+        );
     }
 
@@ -278 +294 @@
      *
      * @since 5.8.0
+
      *
      * @param WP_REST_Request $request Full details about the request.
@@ -283 +300 @@
      */
     public function get_item_permissions_check( $request ) {
-        return $this->permissions_check( $request );
+        if ( current_user_can( 'edit_posts' ) ) {
+            return true;
+        }
+        foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+            if ( current_user_can( $post_type->cap->edit_posts ) ) {
+                return true;
+            }
+        }
+
+        return new WP_Error(
+            'rest_cannot_manage_templates',
+            __( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+            array(
+                'status' => rest_authorization_required_code(),
+            )
+        );
     }
 

trunk/tests/phpunit/tests/rest-api/wpRestTemplatesController.php

@@ -15 +15 @@
      */
     protected static $admin_id;
+
+
     private static $template_post;
     private static $template_part_post;
@@ -24 +26 @@
      */
     public static function wpSetupBeforeClass( $factory ) {
-        self::$admin_id = $factory->user->create(
+        self::$admin_id = $factory->user->create(
             array(
                 'role' => 'administrator',
+
+
+
+
+
+
+
+
+
+
             )
         );
@@ -167 +179 @@
      * @covers WP_REST_Templates_Controller::get_items
      */
-    public function test_get_items_no_permission() {
-        wp_set_current_user( 0 );
+    public function test_get_items_() {
+        wp_set_current_user(  );
         $request  = new WP_REST_Request( 'GET', '/wp/v2/templates' );
         $response = rest_get_server()->dispatch( $request );
-        $this->assertErrorResponse( 'rest_cannot_manage_templates', $response, 401 );
-    }
-
-    /**
-     * @covers WP_REST_Templates_Controller::get_item
-     */
-    public function test_get_item() {
-        wp_set_current_user( self::$admin_id );
-        $request  = new WP_REST_Request( 'GET', '/wp/v2/templates/default//my_template' );
-        $response = rest_get_server()->dispatch( $request );
-        $data     = $response->get_data();
-        unset( $data['content'] );
-        unset( $data['_links'] );
+        $data     = $response->get_data();
 
         $this->assertSame(
@@ -207 +207 @@
                 'original_source' => 'site',
             ),
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
             $data
         );
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
     }