WP_REST_Users_Controller::get_items_permissions_check( WP_REST_Request $request )

Permissions check for getting all users.

Parameters

$request

(Required) Full details about the request.

Return

(true|WP_Error) True if the request has read access, otherwise WP_Error object.

Source

File: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php 

	public function get_items_permissions_check( $request ) {
		// Check if roles is specified in GET request and if user can list users.
		if ( ! empty( $request['roles'] ) && ! current_user_can( 'list_users' ) ) {
			return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to filter users by role.' ), array( 'status' => rest_authorization_required_code() ) );
		}

		if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
			return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
		}

		if ( in_array( $request['orderby'], array( 'email', 'registered_date' ), true ) && ! current_user_can( 'list_users' ) ) {
			return new WP_Error( 'rest_forbidden_orderby', __( 'Sorry, you are not allowed to order users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
		}

		if ( 'authors' === $request['who'] ) {
			$can_view = false;
			$types = get_post_types( array( 'show_in_rest' => true ), 'objects' );
			foreach ( $types as $type ) {
				if ( post_type_supports( $type->name, 'author' )
					&& current_user_can( $type->cap->edit_posts ) ) {
					$can_view = true;
				}
			}
			if ( ! $can_view ) {
				return new WP_Error( 'rest_forbidden_who', __( 'Sorry, you are not allowed to query users by this parameter.' ), array( 'status' => rest_authorization_required_code() ) );
			}
		}

		return true;
	}

Expand Source Code View on GitHub

Related

Uses

Uses
Uses Description
wp-includes/l10n.php: __()

Retrieve the translation of $text.
wp-includes/class-wp-error.php: WP_Error::__construct()

Initialize the error.
wp-includes/capabilities.php: current_user_can()

Whether the current user has a specific capability.
wp-includes/rest-api.php: rest_authorization_required_code()

Returns a contextual HTTP error code for authorization failure.
wp-includes/post.php: post_type_supports()

Check a post type’s support for a given feature.
wp-includes/post.php: get_post_types()

Get a list of all registered post type objects.
Show 1 more use Hide more uses

Changelog

Changelog
Version Description
WP-4.7.0 Introduced.