| @@ -221,9 +221,9 @@ | ||
| 221 | 221 | |
| 222 | 222 | $post_id = $params['current_post_id']; |
| 223 | 223 | |
| 224 | 224 | if ( is_numeric( $post_id ) && |
| 225 | - ! current_user_can( 'manage_options' ) && | |
| 225 | + ! current_user_can( 'edit_post', $post_id ) && | |
| 226 | 226 | get_post_status( $post_id ) !== 'publish' |
| 227 | 227 | ) { |
| 228 | 228 | return new WP_REST_Response( |
| 229 | 229 | [ |
| @@ -692,8 +692,9 @@ | ||
| 692 | 692 | 'edit_users', |
| 693 | 693 | 'delete_users', |
| 694 | 694 | 'create_users', |
| 695 | 695 | 'promote_users', |
| 696 | + 'edit_theme_options', | |
| 696 | 697 | ]; |
| 697 | 698 | foreach ( $privileged_caps as $cap ) { |
| 698 | 699 | if ( ! empty( $role_obj->capabilities[ $cap ] ) ) { |
| 699 | 700 | return false; |
| @@ -698,8 +699,20 @@ | ||
| 698 | 699 | if ( ! empty( $role_obj->capabilities[ $cap ] ) ) { |
| 699 | 700 | return false; |
| 700 | 701 | } |
| 701 | 702 | } |
| 703 | + | |
| 704 | + // The checks above read the role's stored capabilities, which never | |
| 705 | + // include anything the permission map grants — those are added per | |
| 706 | + // request and are invisible here. A role configured for the Site Editor | |
| 707 | + // would sail through, so a self-registration form could hand a visitor | |
| 708 | + // edit_theme_options. Ask the permission map directly. | |
| 709 | + $bridged = \ABlocks\Permissions\Caps::native_bridge(); | |
| 710 | + $grants = \ABlocks\Permissions::get_role_grants( $role ); | |
| 711 | + if ( array_intersect( array_keys( $bridged ), $grants ) ) { | |
| 712 | + return false; | |
| 713 | + } | |
| 714 | + | |
| 702 | 715 | return true; |
| 703 | 716 | } |
| 704 | 717 | |
| 705 | 718 | private function submit_schema() { |
