= get_userdata( $object_id ); $shop_manager_editable_roles = apply_filters( 'woocommerce_shop_manager_editable_roles', array( 'customer' ) ); if ( isset( $user_data->roles ) ) { $can_manage_users = array_intersect( $user_data->roles, array_unique( $shop_manager_editable_roles ) ); // Check if Shop Manager can edit customer or with the is same shop manager. if ( 0 < count( $can_manage_users ) || intval( $object_id ) === intval( get_current_user_id() ) ) { $permission = current_user_can( $contexts[ $context ], $object_id ); } } } else { $permission = current_user_can( $contexts[ $context ], $object_id ); } // Possibly revoke $permission if the user is 'out of bounds' from a multisite-network perspective. if ( $permission && ! Users::get_user_in_current_site( $object_id ) ) { $permission = false; } /** * Provides an opportunity to override the permission check made before acting on an object in relation to * REST API requests. * * @since 2.6.0 * * @param bool $permission If we have permission to act on this object. * @param string $context Describes the operation being performed: 'read', 'edit', 'delete', etc. * @param int $object_id Object ID. This could be a user ID, order ID, post ID, etc. * @param string $object_type Type of object ('user', 'shop_order', etc) for which checks are being made. */ return apply_filters( 'woocommerce_rest_check_permissions', $permission, $context, $object_id, 'user' ); } /** * Check permissions of product terms on REST API. * * @since 2.6.0 * @param string $taxonomy Taxonomy. * @param string $context Request context. * @param int $object_id Post ID. * @return bool */ function wc_rest_check_product_term_permissions( $taxonomy, $context = 'read', $object_id = 0 ) { $contexts = array( 'read' => 'manage_terms', 'create' => 'edit_terms', 'edit' => 'edit_terms', 'delete' => 'delete_terms', 'batch' => 'edit_terms', ); $cap = $contexts[ $context ]; $taxonomy_object = get_taxonomy( $taxonomy ); $permission = current_user_can( $taxonomy_object->cap->$cap, $object_id ); return apply_filters( 'woocommerce_rest_check_permissions', $permission, $context, $object_id, $taxonomy ); } /** * Check manager permissions on REST API. * * @since 2.6.0 * @param string $object Object. * @param string $context Request context. * @return bool */ function wc_rest_check_manager_permissions( $object, $context = 'read' ) { $objects = array( 'reports' => 'view_woocommerce_reports', 'settings' => 'manage_woocommerce', 'system_status' => 'manage_woocommerce', 'attributes' => 'manage_product_terms', 'shipping_methods' => 'manage_woocommerce', 'payment_gateways' => 'manage_woocommerce', 'webhooks' => 'manage_woocommerce', ); $permission = current_user_can( $objects[ $object ] ); return apply_filters( 'woocommerce_rest_check_permissions', $permission, $context, 0, $object ); } /** * Check product reviews permissions on REST API. * * @since 3.5.0 * @param string $context Request context. * @param string $object_id Object ID. * @return bool */ function wc_rest_check_product_reviews_permissions( $context = 'read', $object_id = 0 ) { $permission = false; $contexts = array( 'read' => 'moderate_comments', 'create' => 'edit_products', 'edit' => 'edit_products', 'delete' => 'edit_products', 'batch' => 'edit_products', ); if ( $object_id > 0 ) { $object = get_comment( $object_id ); if ( ! is_a( $object, 'WP_Comment' ) || get_comment_type( $object ) !== 'review' ) { return false; } } if ( isset( $contexts[ $context ] ) ) { $permission = current_user_can( $contexts[ $context ], $object_id ); } return apply_filters( 'woocommerce_rest_check_permissions', $permission, $context, $object_id, 'product_review' ); } /** * Returns true if the current REST request is from the product editor. * * @since 8.9.0 * @return bool */ function wc_rest_is_from_product_editor() { return isset( $_SERVER['HTTP_X_WC_FROM_PRODUCT_EDITOR'] ) && '1' === $_SERVER['HTTP_X_WC_FROM_PRODUCT_EDITOR']; } /** * Check if a REST namespace should be loaded. Useful to maintain site performance even when lots of REST namespaces are registered. * * @since 9.2.0. * * @param string $ns The namespace to check. * @param string $rest_route (Optional) The REST route being checked. * * @return bool True if the namespace should be loaded, false otherwise. */ function wc_rest_should_load_namespace( string $ns, string $rest_route = '' ): bool { if ( '' === $rest_route ) { $rest_route = $GLOBALS['wp']->query_vars['rest_route'] ?? ''; } if ( '' === $rest_route ) { return true; } $rest_route = trailingslashit( ltrim( $rest_route, '/' ) ); $ns = trailingslashit( $ns ); /** * Known namespaces that we know are safe to not load if the request is not for them. Namespaces not in this namespace should always be loaded, because we don't know if they won't be making another internal REST request to an unloaded namespace. */ $known_namespaces = array( 'wc/v1', 'wc/v2', 'wc/v3', 'wc/v4', 'wc-telemetry', 'wc-admin', 'wc-analytics', 'wc/store', 'wc/private', ); $known_namespace_request = false; foreach ( $known_namespaces as $known_namespace ) { if ( str_starts_with( $rest_route, $known_namespace ) ) { $known_namespace_request = true; break; } } if ( ! $known_namespace_request ) { return true; } /** * Filters whether a namespace should be loaded. * * @param bool $should_load True if the namespace should be loaded, false otherwise. * @param string $ns The namespace to check. * @param string $rest_route The REST route being checked. * @param array $known_namespaces Known namespaces that we know are safe to not load if the request is not for them. * * @since 9.4 */ return apply_filters( 'wc_rest_should_load_namespace', str_starts_with( $rest_route, $ns ), $ns, $rest_route, $known_namespaces ); }