@@ 138-152 (lines=15) @@ | ||
135 | { |
|
136 | Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_edit, 'create'); |
|
137 | $default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap(); |
|
138 | if (! current_user_can($default_cap_to_check_for)) { |
|
139 | throw new RestException( |
|
140 | 'rest_cannot_create_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())), |
|
141 | sprintf( |
|
142 | esc_html__( |
|
143 | // @codingStandardsIgnoreStart |
|
144 | 'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to insert data into Event Espresso.', |
|
145 | // @codingStandardsIgnoreEnd |
|
146 | 'event_espresso' |
|
147 | ), |
|
148 | $default_cap_to_check_for |
|
149 | ), |
|
150 | array('status' => 403) |
|
151 | ); |
|
152 | } |
|
153 | $submitted_json_data = array_merge((array)$request->get_body_params(), (array)$request->get_json_params()); |
|
154 | $model_data = ModelDataTranslator::prepareConditionsQueryParamsForModels( |
|
155 | $submitted_json_data, |
|
@@ 191-205 (lines=15) @@ | ||
188 | { |
|
189 | Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_edit, 'edit'); |
|
190 | $default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap(); |
|
191 | if (! current_user_can($default_cap_to_check_for)) { |
|
192 | throw new RestException( |
|
193 | 'rest_cannot_edit_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())), |
|
194 | sprintf( |
|
195 | esc_html__( |
|
196 | // @codingStandardsIgnoreStart |
|
197 | 'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to update data into Event Espresso.', |
|
198 | // @codingStandardsIgnoreEnd |
|
199 | 'event_espresso' |
|
200 | ), |
|
201 | $default_cap_to_check_for |
|
202 | ), |
|
203 | array('status' => 403) |
|
204 | ); |
|
205 | } |
|
206 | $obj_id = $request->get_param('id'); |
|
207 | if (! $obj_id) { |
|
208 | throw new RestException( |
|
@@ 246-260 (lines=15) @@ | ||
243 | { |
|
244 | Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_delete, 'delete'); |
|
245 | $default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap(); |
|
246 | if (! current_user_can($default_cap_to_check_for)) { |
|
247 | throw new RestException( |
|
248 | 'rest_cannot_delete_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())), |
|
249 | sprintf( |
|
250 | esc_html__( |
|
251 | // @codingStandardsIgnoreStart |
|
252 | 'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to delete data into Event Espresso.', |
|
253 | // @codingStandardsIgnoreEnd |
|
254 | 'event_espresso' |
|
255 | ), |
|
256 | $default_cap_to_check_for |
|
257 | ), |
|
258 | array('status' => 403) |
|
259 | ); |
|
260 | } |
|
261 | $obj_id = $request->get_param('id'); |
|
262 | //this is where we would apply more fine-grained caps |
|
263 | $model_obj = $model->get_one_by_ID($obj_id); |