Skip to content

Commit 5e2c4fb

Browse files
committed
Add clarifying comments to global styles permission check
Comments explain why `true` is returned for missing/wrong post type (defers to the handler for a 404) and why `edit_post` is only checked after confirming the post is a global styles post.
1 parent 393aaca commit 5e2c4fb

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

src/Ability/Concerns/Permissions.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -438,10 +438,12 @@ private function can_update_global_styles_request( $params ) {
438438
}
439439

440440
$post = get_post( (int) $params['id'] );
441+
// Let the handler return a normal 404 for missing posts or wrong post types.
441442
if ( ! $post || 'wp_global_styles' !== $post->post_type ) {
442443
return true;
443444
}
444445

446+
// Only enforce object-level edit permissions after confirming this is a global styles post.
445447
return $this->current_user_can_cap( 'edit_post', (int) $post->ID ) ? true : $this->permission_error( 'Access denied for editing this global styles post.' );
446448
}
447449

0 commit comments

Comments
 (0)