feat: Allow view access of navigation REST endpoint to anyone with edit_post capability.#69794
Conversation
…e edit_post capability.
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Unlinked AccountsThe following contributors have not linked their GitHub and WordPress.org accounts: @jonnynews. Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases. If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
|
👋 Thanks for your first Pull Request and for helping build the future of Gutenberg and WordPress, @coder-rancho! In case you missed it, we'd love to have you join us in our Slack community. If you want to learn more about WordPress development in general, check out the Core Handbook full of helpful information. |
…'t have ability to edit navigation.
|
Thanks for contributing, @coder-rancho! I don't think there's a need to copy the solution from #60317 for the Navigation block. Instead, we should modify the P.S. The Correct folder for this enhancement would be |
|
Thanks for the suggestion @Mamaduka. But I still think we need this implementation because We cannot allow Editor to update |
We should experiment and see if we can request a Navigation item in |
Setting the context as |
|
We'll have to re-arrange how the Navigation blocks edit component is rendered, but technically, it should be doable. That's one of the reasons I suggested combining PRs (#69806 (comment)). If we go to the post type capabilities route, PHP changes should be minimal, so there's no reason to split PRs, and that would make it easier to test. |
|
Alright, I'll spend some time to figure it out. |
spacedmonkey
left a comment
There was a problem hiding this comment.
I am not sure about this change. This could be seen as leaking information. Can you provide more context on why this is needed?
|
@spacedmonkey, the associated issue explains this: #60809. tl;dr; Editor needs to render, non-editable Navigation block for low-cap users, currently requests will fail and block will display "Missing navigation" message. |
I researched about the above suggestion. Some of the important points to note:
My assumption was partially correct but when we set Hence, even if we want to go this way, we have to hardcode some conditions in REST APIs. |
|
Can we limit this to just context=view then?
|
@jonnynews, we need the block markup which is available only with context=edit. see this comment |
|
@coder-rancho, let's merge/combine #69806 into this one. Otherwise, it would be hard to test these changes. The suggestion (#58301 (comment)) was valid for that case, but I don't think it applies here. Once combined, please update the PR description accordingly 🙇 Regarding the REST API, I think we should try to introduce minimal changes only (or primarily) for the |
What?
Part of #60809, inspired from #60317
Modify the navigation rest endpoint to allow any user role with the edit_post capability to view entities.
Why?
In order to render the navigation block in the locked template preview inside the post editor we need to be able to fetch the contents of any navigation block for any user role that can edit a post.
How?
Overwriting the
get_items_permissions_checkandget_item_permissions_checkmethods of therest_controller_classof thewp_navigationpost type to check whether the current user can edit_posts.Testing Instructions
Testing Instructions for Keyboard
Try making an authenticated rest request to the navigation rest endpoint with any user role that has the edit_post capability. -> The navigation should get returned
Try making an unauthenticated request and still get an unauthorized error.
Note: Make sure to include
?context=editquery param.