Pull in 10up#3004

includes/classes/Feature/SearchOrdering/SearchOrdering.php

@@ -35,6 +35,11 @@ class SearchOrdering extends Feature {
 	 */
 	const TAXONOMY_NAME = 'ep_custom_result';
 
+	/**
+	 * Capability required to manage.
+	 */
+	const CAPABILITY = 'manage_options';
+
 	/**
 	 * Initialize feature setting it's config
 	 *
@@ -210,7 +215,7 @@ public function admin_menu() {
 			'elasticpress',
 			esc_html__( 'Custom Results', 'elasticpress' ),
 			esc_html__( 'Custom Results', 'elasticpress' ),
-			'manage_options',
+			self::CAPABILITY,
 			'edit.php?post_type=' . self::POST_TYPE_NAME
 		);
 	}
@@ -685,7 +690,9 @@ public function rest_api_init() {
 			[
 				'methods'             => 'GET',
 				'callback'            => [ $this, 'handle_pointer_search' ],
-				'permission_callback' => '__return_true',
+				'permission_callback' => function() {
+					return current_user_can( self::CAPABILITY );
+				},
 				'args'                => [
 					's' => [
 						'validate_callback' => function ( $param ) {
@@ -703,7 +710,9 @@ public function rest_api_init() {
 			[
 				'methods'             => 'GET',
 				'callback'            => [ $this, 'handle_pointer_preview' ],
-				'permission_callback' => '__return_true',
+				'permission_callback' => function() {
+					return current_user_can( self::CAPABILITY );
+				},
 				'args'                => [
 					's' => [
 						'validate_callback' => function ( $param ) {