| @@ -25,13 +25,21 @@ | ||
| 25 | 25 | } |
| 26 | 26 | |
| 27 | 27 | public function permission_check( WP_REST_Request $request ) { |
| 28 | 28 | $this->request = $request; |
| 29 | - // $_route = $request->get_route(); | |
| 30 | 29 | |
| 31 | - // if( $_route === '/templately/v1/dependencies/install' && ! Helper::current_user_can( 'install_plugins' ) ) { | |
| 32 | - // return Helper::error('invalid_permission', __( 'Sorry, you do not have permission to install a plugin.', 'templately' ), 'dependencies/install', 403 ); | |
| 33 | - // } | |
| 30 | + // Installing reaches beyond template content, so it does not ride the | |
| 31 | + // `delete_posts` base gate the read routes are happy with. Installer::install() | |
| 32 | + // checks `install_plugins` / `activate_plugins` per plugin as well; this is the | |
| 33 | + // front gate, so the route cannot be probed at all without the capability. | |
| 34 | + if ( $request->get_route() === '/templately/v1/dependencies/install' && ! Helper::current_user_can( 'install_plugins' ) ) { | |
| 35 | + return $this->error( | |
| 36 | + 'invalid_permission', | |
| 37 | + __( 'Sorry, you do not have permission to install a plugin.', 'templately' ), | |
| 38 | + 'dependencies/install', | |
| 39 | + rest_authorization_required_code() | |
| 40 | + ); | |
| 41 | + } | |
| 34 | 42 | |
| 35 | 43 | return true; |
| 36 | 44 | } |
| 37 | 45 | |
