From 24b3f5e77c118442c35527af6dd141b1c3d993bb Mon Sep 17 00:00:00 2001 From: Rachel Baker Date: Sat, 30 Dec 2017 20:36:25 +0000 Subject: [PATCH] REST API: Return the proper status code for failed permission callbacks in `WP_REST_Server->dispatch()`. Use the `rest_authorization_required_code()` function to return a 401 status code when a permission callback fails due to a user not being logged in. Props jaswrks. Fixes #42828. git-svn-id: https://develop.svn.wordpress.org/trunk@42421 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/rest-api/class-wp-rest-server.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/rest-api/class-wp-rest-server.php b/src/wp-includes/rest-api/class-wp-rest-server.php index fbc47dab5b..2a0af4b283 100644 --- a/src/wp-includes/rest-api/class-wp-rest-server.php +++ b/src/wp-includes/rest-api/class-wp-rest-server.php @@ -915,7 +915,7 @@ class WP_REST_Server { if ( is_wp_error( $permission ) ) { $response = $permission; } elseif ( false === $permission || null === $permission ) { - $response = new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to do that.' ), array( 'status' => 403 ) ); + $response = new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to do that.' ), array( 'status' => rest_authorization_required_code() ) ); } } }