Add permission check for retrieving the /posts endpoint when context=… #1412
Conversation
…edit By extension of the fact that getting any individual post yields a forbidden context error when the context=edit and the user is not authorized, the user should also not be permitted to list any post items when unauthorized.
|
@danielpunkass Great catch that we were missing this permission check. I don't know if @WP-API/amigos Any suggestions for the permission check we should be using here? I was thinking something like |
Why not |
WFM |
|
Ah, am I reading this correctly that it would tie the permissions to e.g. whether the user has the ability to edit pages, or a custom post_type? I guess $this->post_type is set as a consequence of the specific endpoint e.g. /posts -> "post", etc? Sounds good to me, I'll update the pull request later tonight probably. |
On advice of @rachelbaker and @danielbachhuber, refine the permissions test to require the user has the edit_posts permission for the specific post_type. Also add a unit test to confirm the functionality of allowing the post list to be retrieved when the user does in fact have the editing capability.
…s/WP-API into forbid-edit-context-listing * 'forbid-edit-context-listing' of github.com:danielpunkass/WP-API: Remove trailing / from /posts in the comment.
… with others that may reject on a specific post type.
Add permission check for retrieving the posts collection in edit context
|
Merged #1412 |
3 participants
…edit
By extension of the fact that getting any individual post yields a forbidden context error when the context=edit and the user is not authorized, the user should also not be permitted to list any post items when unauthorized.