From 780d12608260be0b739ef7b8d4099e579d5d377d Mon Sep 17 00:00:00 2001
From: youknowriad <youknowriad@git.wordpress.org>
Date: Wed, 29 May 2024 07:21:16 +0000
Subject: [PATCH] REST API: Allow view access of template endpoint to anyone
 with the edit_post capability.

In order to render the block template in the locked template preview inside the post editor we need to be able to fetch the contents of any block templates/template parts for any user role that can edit a post.

Props fabiankaegy, youknowriad.
Fixes #61137.
Built from https://develop.svn.wordpress.org/trunk@58227


git-svn-id: http://core.svn.wordpress.org/trunk@57690 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 .../class-wp-rest-templates-controller.php    | 36 +++++++++++++++++--
 wp-includes/version.php                       |  2 +-
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php
index 1c2a7697c4e..949e485fc6c 100644
--- a/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php
+++ b/wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php
@@ -236,12 +236,28 @@ public function _sanitize_template_id( $id ) {
 	 * Checks if a given request has access to read templates.
 	 *
 	 * @since 5.8.0
+	 * @since 6.6.0 Allow users with edit_posts capability to read templates.
 	 *
 	 * @param WP_REST_Request $request Full details about the request.
 	 * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
 	 */
 	public function get_items_permissions_check( $request ) {
-		return $this->permissions_check( $request );
+		if ( current_user_can( 'edit_posts' ) ) {
+			return true;
+		}
+		foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+			if ( current_user_can( $post_type->cap->edit_posts ) ) {
+				return true;
+			}
+		}
+
+		return new WP_Error(
+			'rest_cannot_manage_templates',
+			__( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+			array(
+				'status' => rest_authorization_required_code(),
+			)
+		);
 	}
 
 	/**
@@ -277,12 +293,28 @@ public function get_items( $request ) {
 	 * Checks if a given request has access to read a single template.
 	 *
 	 * @since 5.8.0
+	 * @since 6.6.0 Allow users with edit_posts capability to read individual templates.
 	 *
 	 * @param WP_REST_Request $request Full details about the request.
 	 * @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise.
 	 */
 	public function get_item_permissions_check( $request ) {
-		return $this->permissions_check( $request );
+		if ( current_user_can( 'edit_posts' ) ) {
+			return true;
+		}
+		foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+			if ( current_user_can( $post_type->cap->edit_posts ) ) {
+				return true;
+			}
+		}
+
+		return new WP_Error(
+			'rest_cannot_manage_templates',
+			__( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+			array(
+				'status' => rest_authorization_required_code(),
+			)
+		);
 	}
 
 	/**
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 500da9f8822..72a58b4f409 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.6-alpha-58226';
+$wp_version = '6.6-alpha-58227';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.