| @@ -127,15 +127,23 @@ | ||
| 127 | 127 | /** |
| 128 | 128 | * Registers a REST route. |
| 129 | 129 | * |
| 130 | 130 | * @since 3.17.0 |
| 131 | + * @since 3.24.2 Added the `$permission_callback` parameter. | |
| 131 | 132 | * |
| 132 | - * @param string $route The route to register. | |
| 133 | - * @param string[] $methods Array with the allowed methods. | |
| 134 | - * @param callable $callback Callback function to call when the endpoint is hit. | |
| 135 | - * @param array<mixed> $args The endpoint arguments definition. | |
| 133 | + * @param string $route The route to register. | |
| 134 | + * @param string[] $methods Array with the allowed methods. | |
| 135 | + * @param callable $callback Callback function to call when the endpoint is hit. | |
| 136 | + * @param array<mixed> $args The endpoint arguments definition. | |
| 137 | + * @param callable|null $permission_callback Permission callback to use instead of the default one. | |
| 136 | 138 | */ |
| 137 | - public function register_rest_route( string $route, array $methods, callable $callback, array $args = array() ): void { | |
| 139 | + public function register_rest_route( | |
| 140 | + string $route, | |
| 141 | + array $methods, | |
| 142 | + callable $callback, | |
| 143 | + array $args = array(), | |
| 144 | + ?callable $permission_callback = null | |
| 145 | + ): void { | |
| 138 | 146 | // Trim any possible slashes from the route. |
| 139 | 147 | $route = trim( $route, '/' ); |
| 140 | 148 | |
| 141 | 149 | // Store the route for later reference. |
| @@ -151,9 +159,10 @@ | ||
| 151 | 159 | array( |
| 152 | 160 | array( |
| 153 | 161 | 'methods' => $methods, |
| 154 | 162 | 'callback' => $callback, |
| 155 | - 'permission_callback' => array( $this, 'is_available_to_current_user' ), | |
| 163 | + 'permission_callback' => $permission_callback ?? | |
| 164 | + array( $this, 'is_available_to_current_user' ), | |
| 156 | 165 | 'args' => $args, |
| 157 | 166 | 'show_in_index' => ! is_wp_error( $this->is_available_to_current_user() ), |
| 158 | 167 | ), |
| 159 | 168 | ) |
| @@ -241,8 +250,13 @@ | ||
| 241 | 250 | * applied capability filters. |
| 242 | 251 | * |
| 243 | 252 | * The default access capability is not passed here by default, to allow for |
| 244 | 253 | * a more explicit declaration in child classes. |
| 254 | + * | |
| 255 | + * The result is checked with current_user_can(), so a capability such as | |
| 256 | + * `exist` makes the endpoint available to everyone, unless other checks | |
| 257 | + * apply: post-specific routes also require edit access to the post, and | |
| 258 | + * Content Intelligence routes also check the user's role. | |
| 245 | 259 | * |
| 246 | 260 | * @since 3.14.0 |
| 247 | 261 | * @since 3.17.0 Moved to the new API structure. |
| 248 | 262 | * |
