WP_REST_Users_Controller::get_items_permissions_check │ public │ WP 4.7.0

Permissions check for getting all users.

Method of the class: WP_REST_Users_Controller{}

No Hooks.

Returns

true|WP_Error. True if the request has read access, otherwise WP_Error object.

Usage

$WP_REST_Users_Controller = new WP_REST_Users_Controller();
$WP_REST_Users_Controller->get_items_permissions_check( $request );

$request(WP_REST_Request) (required)

Full details about the request.

Changelog

WP_REST_Users_Controller::get_items_permissions_check() WP REST Users Controller::get items permissions check code ^{WP 6.9.1}

public function get_items_permissions_check( $request ) {
	// Check if roles is specified in GET request and if user can list users.
	if ( ! empty( $request['roles'] ) && ! current_user_can( 'list_users' ) ) {
		return new WP_Error(
			'rest_user_cannot_view',
			__( 'Sorry, you are not allowed to filter users by role.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	// Check if capabilities is specified in GET request and if user can list users.
	if ( ! empty( $request['capabilities'] ) && ! current_user_can( 'list_users' ) ) {
		return new WP_Error(
			'rest_user_cannot_view',
			__( 'Sorry, you are not allowed to filter users by capability.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
		return new WP_Error(
			'rest_forbidden_context',
			__( 'Sorry, you are not allowed to edit users.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	if ( in_array( $request['orderby'], array( 'email', 'registered_date' ), true ) && ! current_user_can( 'list_users' ) ) {
		return new WP_Error(
			'rest_forbidden_orderby',
			__( 'Sorry, you are not allowed to order users by this parameter.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	if ( 'authors' === $request['who'] ) {
		$types = get_post_types( array( 'show_in_rest' => true ), 'objects' );

		foreach ( $types as $type ) {
			if ( post_type_supports( $type->name, 'author' )
				&& current_user_can( $type->cap->edit_posts ) ) {
				return true;
			}
		}

		return new WP_Error(
			'rest_forbidden_who',
			__( 'Sorry, you are not allowed to query users by this parameter.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	return true;
}