← All changes | src/Api/Controllers/TourController.php +27 -9 9.0.2 → 9.1.3 View file →

		@@ -23,9 +23,9 @@
23	23	register_rest_route( self::NAMESPACE, '/' . self::BASE, [
24	24	[
25	25	'methods' => 'POST',
26	26	'callback' => [ $this, 'create' ],
27		- 'permission_callback' => [ $this, 'permission_check' ],
	27	+ 'permission_callback' => [ $this, 'create_permission_check' ],
28	28	],
29	29	] );
30	30
31	31	$id_arg = [
		@@ -40,9 +40,9 @@
40	40	register_rest_route( self::NAMESPACE, '/ui-mode', [
41	41	[
42	42	'methods' => 'POST',
43	43	'callback' => [ $this, 'switch_ui_mode' ],
44		- 'permission_callback' => [ $this, 'permission_check' ],
	44	+ 'permission_callback' => [ $this, 'ui_mode_permission_check' ],
45	45	],
46	46	] );
47	47
48	48	register_rest_route( self::NAMESPACE, '/' . self::BASE . '/(?P<id>[\d]+)', [
		@@ -48,21 +48,21 @@
48	48	register_rest_route( self::NAMESPACE, '/' . self::BASE . '/(?P<id>[\d]+)', [
49	49	[
50	50	'methods' => 'GET',
51	51	'callback' => [ $this, 'show' ],
52		- 'permission_callback' => [ $this, 'permission_check' ],
	52	+ 'permission_callback' => [ $this, 'item_permission_check' ],
53	53	'args' => $id_arg,
54	54	],
55	55	[
56	56	'methods' => 'PUT',
57	57	'callback' => [ $this, 'update' ],
58		- 'permission_callback' => [ $this, 'permission_check' ],
	58	+ 'permission_callback' => [ $this, 'item_permission_check' ],
59	59	'args' => $id_arg,
60	60	],
61	61	[
62	62	'methods' => 'DELETE',
63	63	'callback' => [ $this, 'delete' ],
64		- 'permission_callback' => [ $this, 'delete_permission_check' ],
	64	+ 'permission_callback' => [ $this, 'item_permission_check' ],
65	65	'args' => $id_arg,
66	66	],
67	67	] );
68	68
		@@ -112,8 +112,13 @@
112	112
113	113	$post_update = [ 'ID' => $tour_id ];
114	114	$allowed_statuses = [ 'draft', 'publish' ];
115	115	if ( ! empty( $body['status'] ) && in_array( $body['status'], $allowed_statuses, true ) ) {
	116	+ $post_type_obj = get_post_type_object( 'wpvr_item' );
	117	+ $publish_cap = $post_type_obj ? $post_type_obj->cap->publish_posts : 'publish_wpvr_tours';
	118	+ if ( 'publish' === $body['status'] && ! current_user_can( $publish_cap ) ) {
	119	+ return new WP_REST_Response( [ 'message' => __( 'You do not have permission to publish tours.', 'wpvr' ) ], 403 );
	120	+ }
116	121	$post_update['post_status'] = $body['status'];
117	122	}
118	123	if ( isset( $body['title'] ) ) {
119	124	$post_update['post_title'] = sanitize_text_field( $body['title'] );
		@@ -149,12 +154,25 @@
149	154	update_option( 'wpvr_ui_mode', $mode );
150	155	return new WP_REST_Response( [ 'mode' => $mode ], 200 );
151	156	}
152	157
153		- public function permission_check(): bool {
154		- return current_user_can( 'edit_posts' );
	158	+ public function create_permission_check(): bool {
	159	+ $post_type_obj = get_post_type_object( 'wpvr_item' );
	160	+ $create_cap = $post_type_obj ? $post_type_obj->cap->edit_posts : 'edit_wpvr_tours';
	161	+ return current_user_can( $create_cap );
155	162	}
156	163
157		- public function delete_permission_check( WP_REST_Request $request ): bool {
158		- return current_user_can( 'delete_post', (int) $request->get_param( 'id' ) );
	164	+ public function item_permission_check( WP_REST_Request $request ): bool {
	165	+ $tour_id = (int) $request->get_param( 'id' );
	166	+ $post = get_post( $tour_id );
	167	+ if ( ! $post || $post->post_type !== 'wpvr_item' ) {
	168	+ return false;
	169	+ }
	170	+
	171	+ $capability = ( 'DELETE' === $request->get_method() ) ? 'delete_post' : 'edit_post';
	172	+ return current_user_can( $capability, $tour_id );
	173	+ }
	174	+
	175	+ public function ui_mode_permission_check(): bool {
	176	+ return current_user_can( 'manage_options' );
159	177	}
160	178	}