← All changes | modules/wp-rest/base/query.php +18 -2 4.1.0 → 4.2.1 View file →

		@@ -39,8 +39,10 @@
39	39	abstract protected static function get_keys_to_encode(): array;
40	40
41	41	abstract protected function get_endpoint_registration_args(): array;
42	42
	43	+ abstract protected function permission_check( \WP_REST_Request $request ): bool;
	44	+
43	45	public function register( $endpoint, bool $override_existing_endpoints = false ): void {
44	46	register_rest_route( self::NAMESPACE, $endpoint, [
45	47	[
46	48	'methods' => \WP_REST_Server::READABLE,
		@@ -99,12 +101,26 @@
99	101	}, [] );
100	102	}
101	103
102	104
103		- private function validate_access_permission( $request ): bool {
	105	+ protected function validate_access_permission( \WP_REST_Request $request ): bool {
104	106	$nonce = $request->get_header( self::NONCE_KEY );
105	107
106		- return current_user_can( 'edit_posts' ) && wp_verify_nonce( $nonce, 'wp_rest' );
	108	+ return $this->permission_check( $request ) && wp_verify_nonce( $nonce, 'wp_rest' );
	109	+ }
	110	+
	111	+ protected function filter_keys_conversion_map( array $requested_map, array $allowed_map ): array {
	112	+ $sanitized_map = [];
	113	+
	114	+ foreach ( $requested_map as $source_key => $destination_key ) {
	115	+ if ( ! isset( $allowed_map[ $source_key ] ) ) {
	116	+ continue;
	117	+ }
	118	+
	119	+ $sanitized_map[ $source_key ] = $destination_key;
	120	+ }
	121	+
	122	+ return ! empty( $sanitized_map ) ? $sanitized_map : $allowed_map;
107	123	}
108	124
109	125	/**
110	126	* @param callable $cb The route callback.