diff --git a/lib/endpoints/class-wp-rest-users-controller.php b/lib/endpoints/class-wp-rest-users-controller.php index 62cca72802..d6e4fe592f 100755 --- a/lib/endpoints/class-wp-rest-users-controller.php +++ b/lib/endpoints/class-wp-rest-users-controller.php @@ -186,6 +186,7 @@ public function get_item_permissions_check( $request ) { $id = (int) $request['id']; $user = get_userdata( $id ); + $types = get_post_types( array( 'show_in_rest' => true ), 'name' ); if ( empty( $id ) || empty( $user->ID ) ) { return new WP_Error( 'rest_user_invalid_id', __( 'Invalid resource id.' ), array( 'status' => 404 ) ); @@ -201,7 +202,7 @@ public function get_item_permissions_check( $request ) { return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this resource with edit context.' ), array( 'status' => rest_authorization_required_code() ) ); } else if ( 'view' === $context && ! current_user_can( 'list_users' ) ) { return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this resource with view context.' ), array( 'status' => rest_authorization_required_code() ) ); - } else if ( 'embed' === $context && ! count_user_posts( $id ) && ! current_user_can( 'edit_user', $id ) && ! current_user_can( 'list_users' ) ) { + } else if ( 'embed' === $context && ! count_user_posts( $id, $types ) && ! current_user_can( 'edit_user', $id ) && ! current_user_can( 'list_users' ) ) { return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this resource.' ), array( 'status' => rest_authorization_required_code() ) ); } diff --git a/tests/test-rest-users-controller.php b/tests/test-rest-users-controller.php index 2913c8eda8..04f4069c78 100644 --- a/tests/test-rest-users-controller.php +++ b/tests/test-rest-users-controller.php @@ -377,7 +377,7 @@ public function test_get_item_without_permission() { $this->assertErrorResponse( 'rest_user_cannot_view', $response, 403 ); } - public function test_get_item_published_author() { + public function test_get_item_published_author_post() { $this->author_id = $this->factory->user->create( array( 'role' => 'author', ) ); @@ -390,6 +390,19 @@ public function test_get_item_published_author() { $this->check_get_user_response( $response, 'embed' ); } + public function test_get_item_published_author_pages() { + $this->author_id = $this->factory->user->create( array( + 'role' => 'author', + ) ); + $this->post_id = $this->factory->page->create( array( + 'post_author' => $this->author_id, + )); + wp_set_current_user( 0 ); + $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', $this->author_id ) ); + $response = $this->server->dispatch( $request ); + $this->check_get_user_response( $response, 'embed' ); + } + public function test_get_user_with_edit_context() { $user_id = $this->factory->user->create(); $this->allow_user_to_manage_multisite();