W3cubDocs

/WordPress

WP_REST_Posts_Controller::sanitize_post_statuses( string|array $statuses, WP_REST_Request $request, string $parameter )

Sanitizes and validates the list of post statuses, including whether the user can query private statuses.

Parameters

$statuses

(string|array) (Required) One or more post statuses.

$request

(WP_REST_Request) (Required) Full details about the request.

$parameter

(string) (Required) Additional parameter to pass to validation.

Return

(array|WP_Error) A list of valid statuses, otherwise WP_Error object.

Source

File: wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php 

public function sanitize_post_statuses( $statuses, $request, $parameter ) {
		$statuses = wp_parse_slug_list( $statuses );

		// The default status is different in WP_REST_Attachments_Controller.
		$attributes     = $request->get_attributes();
		$default_status = $attributes['args']['status']['default'];

		foreach ( $statuses as $status ) {
			if ( $status === $default_status ) {
				continue;
			}

			$post_type_obj = get_post_type_object( $this->post_type );

			if ( current_user_can( $post_type_obj->cap->edit_posts ) || 'private' === $status && current_user_can( $post_type_obj->cap->read_private_posts ) ) {
				$result = rest_validate_request_arg( $status, $request, $parameter );
				if ( is_wp_error( $result ) ) {
					return $result;
				}
			} else {
				return new WP_Error(
					'rest_forbidden_status',
					__( 'Status is forbidden.' ),
					array( 'status' => rest_authorization_required_code() )
				);
			}
		}

		return $statuses;
	}

Uses

Uses Description
wp-includes/rest-api.php: rest_validate_request_arg()

Validate a request argument based on details registered to the route.
wp-includes/rest-api.php: rest_authorization_required_code()

Returns a contextual HTTP error code for authorization failure.
wp-includes/functions.php: wp_parse_slug_list()

Clean up an array, comma- or space-separated list of slugs.
wp-includes/capabilities.php: current_user_can()

Returns whether the current user has the specified capability.
wp-includes/l10n.php: __()

Retrieve the translation of $text.
wp-includes/post.php: get_post_type_object()

Retrieves a post type object by name.
wp-includes/load.php: is_wp_error()

Check whether variable is a WordPress Error.
wp-includes/class-wp-error.php: WP_Error::__construct()

Initialize the error.

Changelog

Version Description
4.7.0 Introduced.

© 2003–2019 WordPress Foundation
Licensed under the GNU GPLv2+ License.
https://developer.wordpress.org/reference/classes/wp_rest_posts_controller/sanitize_post_statuses