Skip to content
This repository was archived by the owner on Sep 24, 2018. It is now read-only.

Commit 7ba0ae6

Browse files
danielbachhuberdanielbachhuber
committed
Introduce rest_authorization_required_code()
This function produces a contextually-specific HTTP error code based on whether the user is logged in. It should be used when producing an error from a failed `current_user_can()` check, because it's helpful to the client to be able to distinguish between 401 and 403
1 parent 4a2e8c9 commit 7ba0ae6

10 files changed

+50
-39
lines changed

‎lib/endpoints/class-wp-rest-attachments-controller.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ public function create_item( $request ) {
2121
$parent = get_post( (int) $request['post'] );
2222
$post_parent_type = get_post_type_object( $parent->post_type );
2323
if ( ! current_user_can( $post_parent_type->cap->edit_post, $request['post'] ) ) {
24-
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit this post.' ), array( 'status' => 401 ) );
24+
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit this post.' ), array( 'status' => rest_authorization_required_code() ) );
2525
}
2626
}
2727

‎lib/endpoints/class-wp-rest-comments-controller.php‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,7 @@ public function get_items_permissions_check( $request ) {
365365
}
366366

367367
if ( ! empty( $request['context'] ) && 'edit' === $request['context'] && ! current_user_can( 'manage_comments' ) ) {
368-
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view comments with edit context.' ), array( 'status' => 403 ) );
368+
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view comments with edit context.' ), array( 'status' => rest_authorization_required_code() ) );
369369
}
370370

371371
return true;
@@ -387,17 +387,17 @@ public function get_item_permissions_check( $request ) {
387387
}
388388

389389
if ( ! $this->check_read_permission( $comment ) ) {
390-
return new WP_Error( 'rest_cannot_read', __( 'Sorry, you cannot read this comment.' ), array( 'status' => 403 ) );
390+
return new WP_Error( 'rest_cannot_read', __( 'Sorry, you cannot read this comment.' ), array( 'status' => rest_authorization_required_code() ) );
391391
}
392392

393393
$post = get_post( $comment->comment_post_ID );
394394

395395
if ( $post && ! $this->check_read_post_permission( $post ) ) {
396-
return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you cannot read the post for this comment.' ), array( 'status' => 403 ) );
396+
return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you cannot read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
397397
}
398398

399399
if ( ! empty( $request['context'] ) && 'edit' === $request['context'] && ! current_user_can( 'moderate_comments' ) ) {
400-
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view this comment with edit context.' ), array( 'status' => 403 ) );
400+
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view this comment with edit context.' ), array( 'status' => rest_authorization_required_code() ) );
401401
}
402402

403403
return true;
@@ -413,13 +413,13 @@ public function create_item_permissions_check( $request ) {
413413

414414
// Limit who can set comment `author`, `karma` or `status` to anything other than the default.
415415
if ( isset( $request['author'] ) && get_current_user_id() !== $request['author'] && ! current_user_can( 'moderate_comments' ) ) {
416-
return new WP_Error( 'rest_comment_invalid_author', __( 'Comment author invalid.' ), array( 'status' => 403 ) );
416+
return new WP_Error( 'rest_comment_invalid_author', __( 'Comment author invalid.' ), array( 'status' => rest_authorization_required_code() ) );
417417
}
418418
if ( isset( $request['karma'] ) && $request['karma'] > 0 && ! current_user_can( 'moderate_comments' ) ) {
419-
return new WP_Error( 'rest_comment_invalid_karma', __( 'Sorry, you cannot set karma for comments.' ), array( 'status' => 403 ) );
419+
return new WP_Error( 'rest_comment_invalid_karma', __( 'Sorry, you cannot set karma for comments.' ), array( 'status' => rest_authorization_required_code() ) );
420420
}
421421
if ( isset( $request['status'] ) && ! current_user_can( 'moderate_comments' ) ) {
422-
return new WP_Error( 'rest_comment_invalid_status', __( 'Sorry, you cannot set status for comments.' ), array( 'status' => 403 ) );
422+
return new WP_Error( 'rest_comment_invalid_status', __( 'Sorry, you cannot set status for comments.' ), array( 'status' => rest_authorization_required_code() ) );
423423
}
424424

425425
// If the post id isn't specified, presume we can create.
@@ -432,7 +432,7 @@ public function create_item_permissions_check( $request ) {
432432
if ( $post ) {
433433

434434
if ( ! $this->check_read_post_permission( $post ) ) {
435-
return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you cannot read the post for this comment.' ), array( 'status' => 403 ) );
435+
return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you cannot read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
436436
}
437437

438438
if ( ! comments_open( $post->ID ) ) {
@@ -456,7 +456,7 @@ public function update_item_permissions_check( $request ) {
456456
$comment = get_comment( $id );
457457

458458
if ( $comment && ! $this->check_edit_permission( $comment ) ) {
459-
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you can not edit this comment.' ), array( 'status' => 403 ) );
459+
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you can not edit this comment.' ), array( 'status' => rest_authorization_required_code() ) );
460460
}
461461

462462
return true;

‎lib/endpoints/class-wp-rest-meta-posts-controller.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,12 @@ public function get_items_permissions_check( $request ) {
4949
}
5050

5151
if ( ! $this->parent_controller->check_read_permission( $parent ) ) {
52-
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view this post.' ), array( 'status' => 403 ) );
52+
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view this post.' ), array( 'status' => rest_authorization_required_code() ) );
5353
}
5454

5555
$post_type = get_post_type_object( $parent->post_type );
5656
if ( ! current_user_can( $post_type->cap->edit_post, $parent->ID ) ) {
57-
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view the meta for this post.' ), array( 'status' => 403 ) );
57+
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view the meta for this post.' ), array( 'status' => rest_authorization_required_code() ) );
5858
}
5959
return true;
6060
}
@@ -103,12 +103,12 @@ public function delete_item_permissions_check( $request ) {
103103
}
104104

105105
if ( ! $this->parent_controller->check_read_permission( $parent ) ) {
106-
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view this post.' ), array( 'status' => 403 ) );
106+
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view this post.' ), array( 'status' => rest_authorization_required_code() ) );
107107
}
108108

109109
$post_type = get_post_type_object( $parent->post_type );
110110
if ( ! current_user_can( $post_type->cap->delete_post, $parent->ID ) ) {
111-
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot delete the meta for this post.' ), array( 'status' => 403 ) );
111+
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot delete the meta for this post.' ), array( 'status' => rest_authorization_required_code() ) );
112112
}
113113
return true;
114114
}

‎lib/endpoints/class-wp-rest-post-statuses-controller.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public function get_item( $request ) {
7070
*/
7171
public function prepare_item_for_response( $status, $request ) {
7272
if ( ( false === $status->public && ! is_user_logged_in() ) || ( true === $status->internal && is_user_logged_in() ) ) {
73-
return new WP_Error( 'rest_cannot_read_status', __( 'Cannot view status.' ), array( 'status' => 403 ) );
73+
return new WP_Error( 'rest_cannot_read_status', __( 'Cannot view status.' ), array( 'status' => rest_authorization_required_code() ) );
7474
}
7575

7676
$data = array(

‎lib/endpoints/class-wp-rest-post-types-controller.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public function get_item( $request ) {
7070
*/
7171
public function prepare_item_for_response( $post_type, $request ) {
7272
if ( false === $post_type->public ) {
73-
return new WP_Error( 'rest_cannot_read_type', __( 'Cannot view type.' ), array( 'status' => 403 ) );
73+
return new WP_Error( 'rest_cannot_read_type', __( 'Cannot view type.' ), array( 'status' => rest_authorization_required_code() ) );
7474
}
7575

7676
$data = array(

‎lib/endpoints/class-wp-rest-posts-controller.php‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -337,7 +337,7 @@ public function delete_item( $request ) {
337337
$supports_trash = apply_filters( 'rest_post_trashable', $supports_trash, $post );
338338

339339
if ( ! $this->check_delete_permission( $post ) ) {
340-
return new WP_Error( 'rest_user_cannot_delete_post', __( 'Sorry, you are not allowed to delete this post.' ), array( 'status' => 401 ) );
340+
return new WP_Error( 'rest_user_cannot_delete_post', __( 'Sorry, you are not allowed to delete this post.' ), array( 'status' => rest_authorization_required_code() ) );
341341
}
342342

343343
$request = new WP_REST_Request( 'GET', '/wp/v2/' . $this->get_post_type_base( $this->post_type ) . '/' . $post->ID );
@@ -399,7 +399,7 @@ public function get_items_permissions_check( $request ) {
399399
$post_type = get_post_type_object( $this->post_type );
400400

401401
if ( 'edit' === $request['context'] && ! current_user_can( $post_type->cap->edit_posts ) ) {
402-
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit these posts in this post type' ), array( 'status' => 403 ) );
402+
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit these posts in this post type' ), array( 'status' => rest_authorization_required_code() ) );
403403
}
404404

405405
return true;
@@ -416,7 +416,7 @@ public function get_item_permissions_check( $request ) {
416416
$post = get_post( (int) $request['id'] );
417417

418418
if ( 'edit' === $request['context'] && $post && ! $this->check_update_permission( $post ) ) {
419-
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit this post' ), array( 'status' => 403 ) );
419+
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit this post' ), array( 'status' => rest_authorization_required_code() ) );
420420
}
421421

422422
if ( $post ) {
@@ -437,15 +437,15 @@ public function create_item_permissions_check( $request ) {
437437
$post_type = get_post_type_object( $this->post_type );
438438

439439
if ( ! empty( $request['password'] ) && ! current_user_can( $post_type->cap->publish_posts ) ) {
440-
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create password protected posts in this post type' ), array( 'status' => 403 ) );
440+
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create password protected posts in this post type' ), array( 'status' => rest_authorization_required_code() ) );
441441
}
442442

443443
if ( ! empty( $request['author'] ) && get_current_user_id() !== $request['author'] && ! current_user_can( $post_type->cap->edit_others_posts ) ) {
444-
return new WP_Error( 'rest_cannot_edit_others', __( 'You are not allowed to create posts as this user.' ), array( 'status' => 403 ) );
444+
return new WP_Error( 'rest_cannot_edit_others', __( 'You are not allowed to create posts as this user.' ), array( 'status' => rest_authorization_required_code() ) );
445445
}
446446

447447
if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) ) {
448-
return new WP_Error( 'rest_cannot_assign_sticky', __( 'You do not have permission to make posts sticky.' ), array( 'status' => 403 ) );
448+
return new WP_Error( 'rest_cannot_assign_sticky', __( 'You do not have permission to make posts sticky.' ), array( 'status' => rest_authorization_required_code() ) );
449449
}
450450

451451
return current_user_can( $post_type->cap->create_posts );
@@ -467,15 +467,15 @@ public function update_item_permissions_check( $request ) {
467467
}
468468

469469
if ( ! empty( $request['password'] ) && ! current_user_can( $post_type->cap->publish_posts ) ) {
470-
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create password protected posts in this post type' ), array( 'status' => 403 ) );
470+
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create password protected posts in this post type' ), array( 'status' => rest_authorization_required_code() ) );
471471
}
472472

473473
if ( ! empty( $request['author'] ) && get_current_user_id() !== $request['author'] && ! current_user_can( $post_type->cap->edit_others_posts ) ) {
474-
return new WP_Error( 'rest_cannot_edit_others', __( 'You are not allowed to update posts as this user.' ), array( 'status' => 403 ) );
474+
return new WP_Error( 'rest_cannot_edit_others', __( 'You are not allowed to update posts as this user.' ), array( 'status' => rest_authorization_required_code() ) );
475475
}
476476

477477
if ( ! empty( $request['sticky'] ) && ! current_user_can( $post_type->cap->edit_others_posts ) ) {
478-
return new WP_Error( 'rest_cannot_assign_sticky', __( 'You do not have permission to make posts sticky.' ), array( 'status' => 403 ) );
478+
return new WP_Error( 'rest_cannot_assign_sticky', __( 'You do not have permission to make posts sticky.' ), array( 'status' => rest_authorization_required_code() ) );
479479
}
480480

481481
return true;
@@ -492,7 +492,7 @@ public function delete_item_permissions_check( $request ) {
492492
$post = get_post( $request['id'] );
493493

494494
if ( $post && ! $this->check_delete_permission( $post ) ) {
495-
return new WP_Error( 'rest_cannot_delete', __( 'Sorry, you are not allowed to delete posts.' ), array( 'status' => 403 ) );
495+
return new WP_Error( 'rest_cannot_delete', __( 'Sorry, you are not allowed to delete posts.' ), array( 'status' => rest_authorization_required_code() ) );
496496
}
497497

498498
return true;
@@ -816,13 +816,13 @@ protected function handle_status_param( $post_status, $post_type ) {
816816
break;
817817
case 'private':
818818
if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
819-
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create private posts in this post type' ), array( 'status' => 403 ) );
819+
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create private posts in this post type' ), array( 'status' => rest_authorization_required_code() ) );
820820
}
821821
break;
822822
case 'publish':
823823
case 'future':
824824
if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
825-
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to publish posts in this post type' ), array( 'status' => 403 ) );
825+
return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to publish posts in this post type' ), array( 'status' => rest_authorization_required_code() ) );
826826
}
827827
break;
828828
default:
@@ -1606,7 +1606,7 @@ public function validate_user_can_query_private_statuses( $value, $request, $par
16061606
if ( current_user_can( $post_type_obj->cap->edit_posts ) ) {
16071607
return true;
16081608
}
1609-
return new WP_Error( 'rest_forbidden_status', __( 'Status is forbidden' ), array( 'status' => 403 ) );
1609+
return new WP_Error( 'rest_forbidden_status', __( 'Status is forbidden' ), array( 'status' => rest_authorization_required_code() ) );
16101610
}
16111611

16121612
}

‎lib/endpoints/class-wp-rest-posts-terms-controller.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ protected function validate_request( $request ) {
218218
}
219219

220220
if ( ! $this->posts_controller->check_read_permission( $post ) ) {
221-
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view this post.' ), array( 'status' => 403 ) );
221+
return new WP_Error( 'rest_forbidden', __( 'Sorry, you cannot view this post.' ), array( 'status' => rest_authorization_required_code() ) );
222222
}
223223

224224
if ( ! empty( $request['term_id'] ) ) {

‎lib/endpoints/class-wp-rest-revisions-controller.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ public function get_items_permissions_check( $request ) {
9191
}
9292
$parent_post_type_obj = get_post_type_object( $parent->post_type );
9393
if ( ! current_user_can( $parent_post_type_obj->cap->edit_post, $parent->ID ) ) {
94-
return new WP_Error( 'rest_cannot_read', __( 'Sorry, you cannot view revisions of this post.' ), array( 'status' => 403 ) );
94+
return new WP_Error( 'rest_cannot_read', __( 'Sorry, you cannot view revisions of this post.' ), array( 'status' => rest_authorization_required_code() ) );
9595
}
9696

9797
return true;

‎lib/endpoints/class-wp-rest-users-controller.php‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -392,11 +392,11 @@ public function get_item_permissions_check( $request ) {
392392
$context = ! empty( $request['context'] ) && in_array( $request['context'], array( 'edit', 'view', 'embed' ) ) ? $request['context'] : 'embed';
393393

394394
if ( 'edit' === $context && ! current_user_can( 'edit_user', $id ) ) {
395-
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this user with edit context' ), array( 'status' => 403 ) );
395+
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this user with edit context' ), array( 'status' => rest_authorization_required_code() ) );
396396
} else if ( 'view' === $context && ! current_user_can( 'list_users' ) ) {
397-
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this user with view context' ), array( 'status' => 403 ) );
397+
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this user with view context' ), array( 'status' => rest_authorization_required_code() ) );
398398
} else if ( 'embed' === $context && ! count_user_posts( $id ) && ! current_user_can( 'edit_user', $id ) && ! current_user_can( 'list_users' ) ) {
399-
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this user' ), array( 'status' => 403 ) );
399+
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you cannot view this user' ), array( 'status' => rest_authorization_required_code() ) );
400400
}
401401

402402
return true;
@@ -411,7 +411,7 @@ public function get_item_permissions_check( $request ) {
411411
public function create_item_permissions_check( $request ) {
412412

413413
if ( ! current_user_can( 'create_users' ) ) {
414-
return new WP_Error( 'rest_cannot_create_user', __( 'Sorry, you are not allowed to create users.' ), array( 'status' => 403 ) );
414+
return new WP_Error( 'rest_cannot_create_user', __( 'Sorry, you are not allowed to create users.' ), array( 'status' => rest_authorization_required_code() ) );
415415
}
416416

417417
return true;
@@ -428,11 +428,11 @@ public function update_item_permissions_check( $request ) {
428428
$id = (int) $request['id'];
429429

430430
if ( ! current_user_can( 'edit_user', $id ) ) {
431-
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit users.' ), array( 'status' => 403 ) );
431+
return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit users.' ), array( 'status' => rest_authorization_required_code() ) );
432432
}
433433

434434
if ( ! empty( $request['role'] ) && ! current_user_can( 'edit_users' ) ) {
435-
return new WP_Error( 'rest_cannot_edit_roles', __( 'Sorry, you are not allowed to edit roles of users.' ), array( 'status' => 403 ) );
435+
return new WP_Error( 'rest_cannot_edit_roles', __( 'Sorry, you are not allowed to edit roles of users.' ), array( 'status' => rest_authorization_required_code() ) );
436436
}
437437

438438
return true;
@@ -450,7 +450,7 @@ public function delete_item_permissions_check( $request ) {
450450
$reassign = isset( $request['reassign'] ) ? absint( $request['reassign'] ) : null;
451451

452452
if ( ! current_user_can( 'delete_user', $id ) ) {
453-
return new WP_Error( 'rest_user_cannot_delete', __( 'Sorry, you are not allowed to delete this user.' ), array( 'status' => 403 ) );
453+
return new WP_Error( 'rest_user_cannot_delete', __( 'Sorry, you are not allowed to delete this user.' ), array( 'status' => rest_authorization_required_code() ) );
454454
}
455455

456456
return true;
@@ -608,7 +608,7 @@ protected function check_role_update( $user_id, $role ) {
608608
return true;
609609
}
610610

611-
return new WP_Error( 'rest_user_invalid_role', __( 'You cannot give users that role.' ), array( 'status' => 403 ) );
611+
return new WP_Error( 'rest_user_invalid_role', __( 'You cannot give users that role.' ), array( 'status' => rest_authorization_required_code() ) );
612612
}
613613

614614
/**

‎plugin.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,17 @@ function create_initial_rest_routes() {
220220
$controller->register_routes();
221221
}
222222

223+
if ( ! function_exists( 'rest_authorization_required_code' ) ) {
224+
/**
225+
* Returns a contextual HTTP error code for authorization failure.
226+
*
227+
* @return integer
228+
*/
229+
function rest_authorization_required_code() {
230+
return is_user_logged_in() ? 403 : 401;
231+
}
232+
}
233+
223234
if ( ! function_exists( 'register_api_field' ) ) {
224235
/**
225236
* Registers a new field on an existing WordPress object type.

0 commit comments

Comments
 (0)