REST API: Allow view access of template endpoint to anyone with the e…

…dit_post capability.

In order to render the block template in the locked template preview inside the post editor we need to be able to fetch the contents of any block templates/template parts for any user role that can edit a post.

Props fabiankaegy, youknowriad.
Fixes #61137.
Built from https://develop.svn.wordpress.org/trunk@58227


git-svn-id: https://core.svn.wordpress.org/trunk@57690 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-includes/rest-api/endpoints/class-wp-rest-templates-controller.php

@@ -236,12 +236,28 @@ public function _sanitize_template_id( $id ) {
 	 * Checks if a given request has access to read templates.
 	 *
 	 * @since 5.8.0
+	 * @since 6.6.0 Allow users with edit_posts capability to read templates.
 	 *
 	 * @param WP_REST_Request $request Full details about the request.
 	 * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
 	 */
 	public function get_items_permissions_check( $request ) {
-		return $this->permissions_check( $request );
+		if ( current_user_can( 'edit_posts' ) ) {
+			return true;
+		}
+		foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+			if ( current_user_can( $post_type->cap->edit_posts ) ) {
+				return true;
+			}
+		}
+
+		return new WP_Error(
+			'rest_cannot_manage_templates',
+			__( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+			array(
+				'status' => rest_authorization_required_code(),
+			)
+		);
 	}
 
 	/**
@@ -277,12 +293,28 @@ public function get_items( $request ) {
 	 * Checks if a given request has access to read a single template.
 	 *
 	 * @since 5.8.0
+	 * @since 6.6.0 Allow users with edit_posts capability to read individual templates.
 	 *
 	 * @param WP_REST_Request $request Full details about the request.
 	 * @return true|WP_Error True if the request has read access for the item, WP_Error object otherwise.
 	 */
 	public function get_item_permissions_check( $request ) {
-		return $this->permissions_check( $request );
+		if ( current_user_can( 'edit_posts' ) ) {
+			return true;
+		}
+		foreach ( get_post_types( array( 'show_in_rest' => true ), 'objects' ) as $post_type ) {
+			if ( current_user_can( $post_type->cap->edit_posts ) ) {
+				return true;
+			}
+		}
+
+		return new WP_Error(
+			'rest_cannot_manage_templates',
+			__( 'Sorry, you are not allowed to access the templates on this site.', 'default' ),
+			array(
+				'status' => rest_authorization_required_code(),
+			)
+		);
 	}
 
 	/**

wp-includes/version.php

@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.6-alpha-58226';
+$wp_version = '6.6-alpha-58227';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.