feature: add permission callback check

impress-org · Jul 10, 2024 · ad3e349 · ad3e349
1 parent eaeecdd
commit ad3e349
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/src/EventTickets/Routes/UpdateEvent.php b/src/EventTickets/Routes/UpdateEvent.php
@@ -28,7 +28,9 @@ public function registerRoute()
                 [
                     'methods' => WP_REST_Server::EDITABLE,
                     'callback' => [$this, 'handleRequest'],
-                    'permission_callback' => '__return_true',
+                    'permission_callback' => function () {
+                        return current_user_can('edit_posts');
+                    },
                 ],
                 'args' => [
                     'event_id' => [
@@ -82,7 +84,7 @@ public function handleRequest(WP_REST_Request $request)
     {
         $event = Event::find($request->get_param('event_id'));
 
-        foreach(['title', 'description', 'startDateTime', 'endDateTime'] as $param) {
+        foreach (['title', 'description', 'startDateTime', 'endDateTime'] as $param) {
             if ($request->has_param($param)) {
                 $event->setAttribute($param, $request->get_param($param));
             }

diff --git a/src/EventTickets/Routes/UpdateEventTicketType.php b/src/EventTickets/Routes/UpdateEventTicketType.php
@@ -30,7 +30,9 @@ public function registerRoute()
                 [
                     'methods' => WP_REST_Server::EDITABLE,
                     'callback' => [$this, 'handleRequest'],
-                    'permission_callback' => '__return_true',
+                    'permission_callback' => function () {
+                        return current_user_can('edit_posts');
+                    },
                 ],
                 'args' => [
                     'ticket_type_id' => [