← All changes | classes/RestAPI.php +0 -60 4.0.3 → 3.7.2 View file →

		@@ -115,68 +115,8 @@
115	115	$this->author_obj = new REST_Author();
116	116	$this->rating_obj = new REST_Rating();
117	117
118	118	add_action( 'rest_api_init', array( $this, 'init_routes' ) );
119		- add_filter( 'rest_request_before_callbacks', array( $this, 'check_permission' ), 10, 3 );
120		- }
121		-
122		- /**
123		- * Check permission before dispatching REST request.
124		- *
125		- * @todo will remove and prevent by capability where needed.
126		- *
127		- * @since 4.0.1
128		- *
129		- * @param mixed $response response.
130		- * @param mixed $handler handler.
131		- * @param \WP_REST_Request $request request.
132		- *
133		- * @return mixed|\WP_Error
134		- */
135		- public function check_permission( $response, $handler, $request ) {
136		- $id = absint( $request['id'] );
137		- $method = $request->get_method();
138		- $write_methods = array( 'POST', 'PUT', 'PATCH', 'DELETE' );
139		- $is_write = in_array( $method, $write_methods, true );
140		-
141		- if ( ! $id ) {
142		- return $response;
143		- }
144		-
145		- $post = get_post( $id );
146		-
147		- if ( ! $post ) {
148		- return $response;
149		- }
150		-
151		- $post_types = array(
152		- tutor()->course_post_type,
153		- tutor()->bundle_post_type,
154		- );
155		-
156		- if ( ! in_array( $post->post_type, $post_types, true ) ) {
157		- return $response;
158		- }
159		-
160		- // Prevent write actions which are only allowed for author.
161		- if ( $is_write && ! current_user_can( 'edit_post', $id ) ) {
162		- return new \WP_Error(
163		- 'rest_forbidden',
164		- tutor_utils()->error_message(),
165		- array( 'status' => rest_authorization_required_code() )
166		- );
167		- }
168		-
169		- // Prevent access to non-publish posts, only author can access.
170		- if ( 'publish' !== $post->post_status && ! current_user_can( 'edit_post', $id ) ) {
171		- return new \WP_Error(
172		- 'rest_forbidden',
173		- tutor_utils()->error_message(),
174		- array( 'status' => rest_authorization_required_code() )
175		- );
176		- }
177		-
178		- return $response;
179	119	}
180	120
181	121	/**
182	122	* Class loading