diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php index 1c2a7697c4..949e485fc6 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php @@ -236,12 +236,28 @@ class WP_REST_Templates_Controller extends WP_REST_Controller { * Checks if a given request has access to read templates. * * @since 5.8.0 + * @since 6.6.0 Allow users with edit_posts capability to read templates. * * @param WP_REST_Request $request Full details about the request. * @return true|WP_Error True if the request has read access, WP_Error object otherwise. */ public function get_items_permissions_check( $request ) { - return $this->permissions_check( $request ); + if ( current_user_can( 'edit_posts' ) ) { + return true; + } + foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) { + if ( current_user_can( $post_type->cap->edit_posts ) ) { + return true; + } + } + + return new WP_Error( + 'rest_cannot_manage_templates', + __( 'Sorry, you are not allowed to access the templates on this site.', 'default' ), + array( + 'status' => rest_authorization_required_code(), + ) + ); } /** @@ -277,12 +293,28 @@ class WP_REST_Templates_Controller extends WP_REST_Controller { * Checks if a given request has access to read a single template. * * @since 5.8.0 + * @since 6.6.0 Allow users with edit_posts capability to read individual templates. * * @param WP_REST_Request $request Full details about the request. * @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise. */ public function get_item_permissions_check( $request ) { - return $this->permissions_check( $request ); + if ( current_user_can( 'edit_posts' ) ) { + return true; + } + foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) { + if ( current_user_can( $post_type->cap->edit_posts ) ) { + return true; + } + } + + return new WP_Error( + 'rest_cannot_manage_templates', + __( 'Sorry, you are not allowed to access the templates on this site.', 'default' ), + array( + 'status' => rest_authorization_required_code(), + ) + ); } /** diff --git a/wp-includes/version.php b/wp-includes/version.php index 500da9f882..72a58b4f40 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -16,7 +16,7 @@ * * @global string $wp_version */ -$wp_version = '6.6-alpha-58226'; +$wp_version = '6.6-alpha-58227'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.