Skip to content
This repository was archived by the owner on Sep 24, 2018. It is now read-only.

Abstract out POST /wp/v2/media permissions check #2003

Merged
rachelbaker merged 2 commits into from
Jan 12, 2016
Merged

Abstract out POST /wp/v2/media permissions check #2003

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c148bc
Abstract out `POST /wp/v2/media` permissions check
danielbachhuber Jan 12, 2016
0bf2812
Clarify error comments and messages
danielbachhuber Jan 12, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 23 additions & 8 deletions lib/endpoints/class-wp-rest-attachments-controller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,28 +3,43 @@
class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {

/**
* Create a single attachment
* Check if a given request has access to create an attachment.
*
* @param WP_REST_Request $request Full details about the request
* @return WP_Error|WP_REST_Response
* @param WP_REST_Request $request Full details about the request.
* @return bool|WP_Error
*/
public function create_item( $request ) {
public function create_item_permissions_check( $request ) {
$ret = parent::create_item_permissions_check( $request );
if ( ! $ret || is_wp_error( $ret ) ) {
return $ret;
}

// Permissions check - Note: "upload_files" cap is returned for an attachment by $post_type_obj->cap->create_posts
// "upload_files" cap is returned for an attachment by $post_type_obj->cap->create_posts
$post_type_obj = get_post_type_object( $this->post_type );
if ( ! current_user_can( $post_type_obj->cap->create_posts ) || ! current_user_can( $post_type_obj->cap->edit_posts ) ) {
return new WP_Error( 'rest_cannot_create', __( 'Sorry, you are not allowed to post on this site.' ), array( 'status' => 400 ) );
return new WP_Error( 'rest_cannot_create', __( 'Sorry, you are not allowed to upload media on this site.' ), array( 'status' => 400 ) );
}

// If a user is trying to attach to a post make sure they have permissions. Bail early if post_id is not being passed
// Attaching media to a post requires ability to edit said post
if ( ! empty( $request['post'] ) ) {
$parent = get_post( (int) $request['post'] );
$post_parent_type = get_post_type_object( $parent->post_type );
if ( ! current_user_can( $post_parent_type->cap->edit_post, $request['post'] ) ) {
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit this post.' ), array( 'status' => rest_authorization_required_code() ) );
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to upload media to this post.' ), array( 'status' => rest_authorization_required_code() ) );
}
}

return true;
}

/**
* Create a single attachment
*
* @param WP_REST_Request $request Full details about the request
* @return WP_Error|WP_REST_Response
*/
public function create_item( $request ) {

// Get the file via $_FILES or raw data
$files = $request->get_file_params();
$headers = $request->get_headers();
Expand Down