WP_REST_Posts_Controller::sanitize_post_statuses │ public │ WP 4.7.0

Sanitizes and validates the list of post statuses, including whether the user can query private statuses.

Method of the class: WP_REST_Posts_Controller{}

No Hooks.

Returns

Array|WP_Error. A list of valid statuses, otherwise WP_Error object.

Usage

$WP_REST_Posts_Controller = new WP_REST_Posts_Controller();
$WP_REST_Posts_Controller->sanitize_post_statuses( $statuses, $request, $parameter );

$statuses(string|array) (required)

One or more post statuses.

$request(WP_REST_Request) (required)

Full details about the request.

$parameter(string) (required)

Additional parameter to pass to validation.

Changelog

WP_REST_Posts_Controller::sanitize_post_statuses() WP REST Posts Controller::sanitize post statuses code ^{WP 7.0}

public function sanitize_post_statuses( $statuses, $request, $parameter ) {
	$statuses = wp_parse_slug_list( $statuses );

	// The default status is different in WP_REST_Attachments_Controller.
	$attributes     = $request->get_attributes();
	$default_status = $attributes['args']['status']['default'];

	foreach ( $statuses as $status ) {
		if ( $status === $default_status ) {
			continue;
		}

		$post_type_obj = get_post_type_object( $this->post_type );

		if ( current_user_can( $post_type_obj->cap->edit_posts ) || 'private' === $status && current_user_can( $post_type_obj->cap->read_private_posts ) ) {
			$result = rest_validate_request_arg( $status, $request, $parameter );
			if ( is_wp_error( $result ) ) {
				return $result;
			}
		} else {
			return new WP_Error(
				'rest_forbidden_status',
				__( 'Status is forbidden.' ),
				array( 'status' => rest_authorization_required_code() )
			);
		}
	}

	return $statuses;
}