diff --git a/lib/experimental/class-gutenberg-rest-global-styles-revisions-controller.php b/lib/experimental/class-gutenberg-rest-global-styles-revisions-controller.php index eb82053052aec..c5d5a5f0dff1a 100644 --- a/lib/experimental/class-gutenberg-rest-global-styles-revisions-controller.php +++ b/lib/experimental/class-gutenberg-rest-global-styles-revisions-controller.php @@ -265,6 +265,9 @@ public function get_item_permissions_check( $request ) { return $post; } + /* + * The same check as WP_REST_Global_Styles_Controller->get_item_permissions_check. + */ if ( ! current_user_can( 'read_post', $post->ID ) ) { return new WP_Error( 'rest_cannot_view', diff --git a/phpunit/class-gutenberg-rest-global-styles-revisions-controller-test.php b/phpunit/class-gutenberg-rest-global-styles-revisions-controller-test.php index 4dcf1585e9596..6856638bf8754 100644 --- a/phpunit/class-gutenberg-rest-global-styles-revisions-controller-test.php +++ b/phpunit/class-gutenberg-rest-global-styles-revisions-controller-test.php @@ -11,6 +11,11 @@ class Gutenberg_REST_Global_Styles_Revisions_Controller_Test extends WP_Test_RES */ protected static $second_admin_id; + /** + * @var int + */ + protected static $author_id; + /** * @var int */ @@ -37,6 +42,11 @@ public static function wpSetupBeforeClass( $factory ) { 'role' => 'administrator', ) ); + self::$author_id = $factory->user->create( + array( + 'role' => 'author', + ) + ); // This creates the global styles for the current theme. self::$global_styles_id = wp_insert_post( array( @@ -160,6 +170,17 @@ public function test_get_item_schema() { $this->assertArrayHasKey( 'modified_gmt', $properties, 'Schema properties array does not have "modified_gmt" key' ); } + /** + * @covers Gutenberg_REST_Global_Styles_Revisions_Controller::get_item_permissions_check + */ + public function test_get_item_permissions_check() { + wp_set_current_user( self::$author_id ); + $request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/' . self::$global_styles_id . '/revisions' ); + $response = rest_get_server()->dispatch( $request ); + + $this->assertErrorResponse( 'rest_cannot_view', $response, 403 ); + } + /** * @doesNotPerformAssertions */