Changeset 60814

Timestamp:

09/30/2025 03:49:18 PM (8 weeks ago)

Author:

johnbillion

Message:

REST API: Increase the specificity of capability checks for collections when the edit context is in use.

The edit access in now taken into account for each individual post, term, or user in the response.

Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, rmccue, timothyblynjacobs, vortfu, whyisjake, zieladam.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (4 diffs)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -464 +464 @@
 
             foreach ( $query_result as $post ) {
-                if ( ! $this->check_read_permission( $post ) ) {
+                if ( 'edit' === $request['context'] ) {
+                    $permission = $this->check_update_permission( $post );
+                } else {
+                    $permission = $this->check_read_permission( $post );
+                }
+
+                if ( ! $permission ) {
                     continue;
                 }

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php

@@ -366 +366 @@
             $response = array();
             foreach ( $query_result as $term ) {
+                if ( 'edit' === $request['context'] && ! current_user_can( 'edit_term', $term->term_id ) ) {
+                    continue;
+                }
+
                 $data       = $this->prepare_item_for_response( $term, $request );
                 $response[] = $this->prepare_response_for_collection( $data );

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -221 +221 @@
             return new WP_Error(
                 'rest_forbidden_context',
-                __( 'Sorry, you are not allowed to list users.' ),
+                __( 'Sorry, you are not allowed to edit users.' ),
                 array( 'status' => rest_authorization_required_code() )
             );
@@ -380 +380 @@
 
             foreach ( $query->get_results() as $user ) {
+                if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
+                    continue;
+                }
+
                 $data    = $this->prepare_item_for_response( $user, $request );
                 $users[] = $this->prepare_response_for_collection( $data );
@@ -480 +484 @@
         }
 
-        if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
-            return new WP_Error(
-                'rest_user_cannot_view',
-                __( 'Sorry, you are not allowed to list users.' ),
+        if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
+            return new WP_Error(
+                'rest_forbidden_context',
+                __( 'Sorry, you are not allowed to edit this user.' ),
                 array( 'status' => rest_authorization_required_code() )
             );
-        } elseif ( ! count_user_posts( $user->ID, $types ) && ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) ) {
+        }
+
+        if ( ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) && ! count_user_posts( $user->ID, $types ) ) {
             return new WP_Error(
                 'rest_user_cannot_view',
@@ -1087 +1093 @@
         }
 
-        if ( in_array( 'roles', $fields, true ) ) {
+        if ( in_array( 'roles', $fields, true ) && ( current_user_can( 'list_users' ) || current_user_can( 'edit_user', $user->ID ) ) ) {
             // Defensively call array_values() to ensure an array is returned.
             $data['roles'] = array_values( $user->roles );

trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -1314 +1314 @@
         $request->set_param( 'context', 'edit' );
         $response = rest_get_server()->dispatch( $request );
-        $this->assertErrorResponse( 'rest_user_cannot_view', $response, 401 );
+        $this->assertErrorResponse( 'rest_forbidden_context', $response, 401 );
     }