Rest API authentication issue when called from fetch request in bundle.js

The problem is that you’re not using the correct name for the REST API nonce header — the correct name is X-WP-Nonce, but you used X-WP-Header: fetch(‘http://localhost/wptest2/?rest_route=/wp/v2/users/me’, { method : ‘get’, mode : ‘cors’, headers : { ‘Access-Control-Allow-Origin’ : ‘*’, ‘X-WP-Header’ : _wpnonce // here you used the wrong name } }) Reference from the … Read more

Can we access the REST request parameters from within the permission_callback to enforce a 401 by returning false?

I’ve created a reduced test case that demonstrates that what you want to do is achievable: add_action( ‘rest_api_init’, function() { register_rest_route( ‘wpse/343039’, ‘route’, [ ‘methods’ => [ ‘POST’ ], ‘permission_callback’ => function( WP_REST_Request $request ) { if ( ‘1’ == $request->get_param( ‘param’ ) ) { return true; } else { return false; } }, ‘callback’ … Read more

Adding post fields in wp-json/wp/v2/search

For the search endpoint, the object type (the first parameter for register_rest_field()) is search-result and not the post type (e.g. post, page, etc.). So try with this, which worked for me: add_action( ‘rest_api_init’, function () { // Registers a REST field for the /wp/v2/search endpoint. register_rest_field( ‘search-result’, ‘excerpt’, array( ‘get_callback’ => function ( $post_arr ) … Read more

Confused on AJAX submit form through page template

<form action=”<?php echo get_template_directory_uri() . “/validation.php”; ?>” id=”contactForm”> 😱 So I’ll outline the basic fundamentals, so you have a framework to move forwards with Fixing Admin AJAX So I’ll cover this very briefly as it’s not the crux of my answer, but would be useful: Add a hidden input field named action rather than adding … Read more

Disable REST API for a user ROLE

The plugin has a filter drh_allow_rest_api which determines whether the current user has full access and can skip the whitelist check. By default this is just is_user_logged_in(): /** * Allow carte blanche access for logged-in users (or allow override via filter) * * @return bool */ private function allow_rest_api() { return (bool) apply_filters( ‘dra_allow_rest_api’, is_user_logged_in() … Read more