ROBOTSTXT/robotstxt-og
ROBOTSTXT/robotstxt-og
Watch
6
0
Fork
You've already forked robotstxt-og
 0
Code Issues Pull requests Releases 6 Activity

v1.1.0

Browse source
This commit is contained in:
Javier Casares 2026-03-28 07:59:52 +00:00
commit ddaaff71ad
23 changed files with 879 additions and 798 deletions
Download patch file Download diff file Expand all files Collapse all files

25
includes/class-robotstxt-og-rest-api.php
View file

@ -121,7 +121,8 @@ class Robotstxt_OG_REST_API {
* @return WP_REST_Response|WP_Error Response object.
*/
public function handle_resolve( WP_REST_Request $request ) {
$post_id = (int) $request->get_param( 'post_id' );
$param = $request->get_param( 'post_id' );
$post_id = is_numeric( $param ) ? (int) $param : 0;
// Verify post exists.
$post = get_post( $post_id );
@ -159,7 +160,8 @@ class Robotstxt_OG_REST_API {
* @return WP_REST_Response|WP_Error Response object.
*/
public function handle_status( WP_REST_Request $request ) {
$post_id = (int) $request->get_param( 'post_id' );
$param = $request->get_param( 'post_id' );
$post_id = is_numeric( $param ) ? (int) $param : 0;
// Verify post exists.
$post = get_post( $post_id );
@ -189,14 +191,15 @@ class Robotstxt_OG_REST_API {
/**
* Check REST API permission.
*
* Requires manage_options capability.
* Requires edit_others_posts capability (editors and above).
*
* @since 1.0.0
*
* @param WP_REST_Request $request REST request object.
* @return bool|WP_Error True if authorized, WP_Error otherwise.
*/
public function check_permission() {
if ( ! current_user_can( 'manage_options' ) ) {
public function check_permission( WP_REST_Request $request ) {
if ( ! current_user_can( 'edit_others_posts' ) ) {
return new WP_Error(
'rest_forbidden',
__( 'You do not have permission to access this endpoint.', 'robotstxt-og' ),
@ -204,6 +207,18 @@ class Robotstxt_OG_REST_API {
);
}
// For post-specific endpoints, also verify the user can edit that post.
$param = $request->get_param( 'post_id' );
$post_id = is_numeric( $param ) ? (int) $param : 0;
if ( $post_id > 0 && ! current_user_can( 'edit_post', $post_id ) ) {
return new WP_Error(
'rest_forbidden',
__( 'You do not have permission to edit this post.', 'robotstxt-og' ),
array( 'status' => 403 )
);
}
return true;
}
}