WP_REST_Comments_Controller::get_items_permissions_check( WP_REST_Request $request ): true|WP_Error

Source

public function get_items_permissions_check( $request ) {
	$is_note          = 'note' === $request['type'];
	$is_edit_context  = 'edit' === $request['context'];
	$protected_params = array( 'author', 'author_exclude', 'author_email', 'type', 'status' );
	$forbidden_params = array();

	if ( ! empty( $request['post'] ) ) {
		foreach ( (array) $request['post'] as $post_id ) {
			$post = get_post( $post_id );

			if ( ! empty( $post_id ) && $post && ! $this->check_read_post_permission( $post, $request ) ) {
				return new WP_Error(
					'rest_cannot_read_post',
					__( 'Sorry, you are not allowed to read the post for this comment.' ),
					array( 'status' => rest_authorization_required_code() )
				);
			} elseif ( 0 === $post_id && ! current_user_can( 'moderate_comments' ) ) {
				return new WP_Error(
					'rest_cannot_read',
					__( 'Sorry, you are not allowed to read comments without a post.' ),
					array( 'status' => rest_authorization_required_code() )
				);
			}

			if ( $post && $is_note && ! $this->check_post_type_supports_notes( $post->post_type ) ) {
				if ( current_user_can( 'edit_post', $post->ID ) ) {
					return new WP_Error(
						'rest_comment_not_supported_post_type',
						__( 'Sorry, this post type does not support notes.' ),
						array( 'status' => 403 )
					);
				}

				foreach ( $protected_params as $param ) {
					if ( 'status' === $param ) {
						if ( 'approve' !== $request[ $param ] ) {
							$forbidden_params[] = $param;
						}
					} elseif ( 'type' === $param ) {
						if ( 'comment' !== $request[ $param ] ) {
							$forbidden_params[] = $param;
						}
					} elseif ( ! empty( $request[ $param ] ) ) {
						$forbidden_params[] = $param;
					}
				}
				return new WP_Error(
					'rest_forbidden_param',
					/* translators: %s: List of forbidden parameters. */
					sprintf( __( 'Query parameter not permitted: %s' ), implode( ', ', $forbidden_params ) ),
					array( 'status' => rest_authorization_required_code() )
				);
			}
		}
	}

	// Re-map edit context capabilities when requesting `note` for a post.
	if ( $is_edit_context && $is_note && ! empty( $request['post'] ) ) {
		foreach ( (array) $request['post'] as $post_id ) {
			if ( ! current_user_can( 'edit_post', $post_id ) ) {
				return new WP_Error(
					'rest_forbidden_context',
					__( 'Sorry, you are not allowed to edit comments.' ),
					array( 'status' => rest_authorization_required_code() )
				);
			}
		}
	} elseif ( $is_edit_context && ! current_user_can( 'moderate_comments' ) ) {
		return new WP_Error(
			'rest_forbidden_context',
			__( 'Sorry, you are not allowed to edit comments.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	if ( ! current_user_can( 'edit_posts' ) ) {
		foreach ( $protected_params as $param ) {
			if ( 'status' === $param ) {
				if ( 'approve' !== $request[ $param ] ) {
					$forbidden_params[] = $param;
				}
			} elseif ( 'type' === $param ) {
				if ( 'comment' !== $request[ $param ] ) {
					$forbidden_params[] = $param;
				}
			} elseif ( ! empty( $request[ $param ] ) ) {
				$forbidden_params[] = $param;
			}
		}

		if ( ! empty( $forbidden_params ) ) {
			return new WP_Error(
				'rest_forbidden_param',
				/* translators: %s: List of forbidden parameters. */
				sprintf( __( 'Query parameter not permitted: %s' ), implode( ', ', $forbidden_params ) ),
				array( 'status' => rest_authorization_required_code() )
			);
		}
	}

	return true;
}

View all references View on Trac View on GitHub