|
@@ 138-152 (lines=15) @@
|
| 135 |
|
{ |
| 136 |
|
Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_edit, 'create'); |
| 137 |
|
$default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap(); |
| 138 |
|
if (! current_user_can($default_cap_to_check_for)) { |
| 139 |
|
throw new RestException( |
| 140 |
|
'rest_cannot_create_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())), |
| 141 |
|
sprintf( |
| 142 |
|
esc_html__( |
| 143 |
|
// @codingStandardsIgnoreStart |
| 144 |
|
'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to insert data into Event Espresso.', |
| 145 |
|
// @codingStandardsIgnoreEnd |
| 146 |
|
'event_espresso' |
| 147 |
|
), |
| 148 |
|
$default_cap_to_check_for |
| 149 |
|
), |
| 150 |
|
array('status' => 403) |
| 151 |
|
); |
| 152 |
|
} |
| 153 |
|
$submitted_json_data = array_merge((array)$request->get_body_params(), (array)$request->get_json_params()); |
| 154 |
|
$model_data = ModelDataTranslator::prepareConditionsQueryParamsForModels( |
| 155 |
|
$submitted_json_data, |
|
@@ 191-205 (lines=15) @@
|
| 188 |
|
{ |
| 189 |
|
Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_edit, 'edit'); |
| 190 |
|
$default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap(); |
| 191 |
|
if (! current_user_can($default_cap_to_check_for)) { |
| 192 |
|
throw new RestException( |
| 193 |
|
'rest_cannot_edit_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())), |
| 194 |
|
sprintf( |
| 195 |
|
esc_html__( |
| 196 |
|
// @codingStandardsIgnoreStart |
| 197 |
|
'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to update data into Event Espresso.', |
| 198 |
|
// @codingStandardsIgnoreEnd |
| 199 |
|
'event_espresso' |
| 200 |
|
), |
| 201 |
|
$default_cap_to_check_for |
| 202 |
|
), |
| 203 |
|
array('status' => 403) |
| 204 |
|
); |
| 205 |
|
} |
| 206 |
|
$obj_id = $request->get_param('id'); |
| 207 |
|
if (! $obj_id) { |
| 208 |
|
throw new RestException( |
|
@@ 246-260 (lines=15) @@
|
| 243 |
|
{ |
| 244 |
|
Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_delete, 'delete'); |
| 245 |
|
$default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap(); |
| 246 |
|
if (! current_user_can($default_cap_to_check_for)) { |
| 247 |
|
throw new RestException( |
| 248 |
|
'rest_cannot_delete_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())), |
| 249 |
|
sprintf( |
| 250 |
|
esc_html__( |
| 251 |
|
// @codingStandardsIgnoreStart |
| 252 |
|
'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to delete data into Event Espresso.', |
| 253 |
|
// @codingStandardsIgnoreEnd |
| 254 |
|
'event_espresso' |
| 255 |
|
), |
| 256 |
|
$default_cap_to_check_for |
| 257 |
|
), |
| 258 |
|
array('status' => 403) |
| 259 |
|
); |
| 260 |
|
} |
| 261 |
|
$obj_id = $request->get_param('id'); |
| 262 |
|
//this is where we would apply more fine-grained caps |
| 263 |
|
$model_obj = $model->get_one_by_ID($obj_id); |