How to use current_user_can() in register_rest_route()?

You need to pass the wp_rest nonce with the JavaScript request that you send to REST. This nonce is what passes the information from PHP to JavaScript about which user is making the request. Example: <form> <input type=”text” name=”rest_auth_nonce” value=”<?= esc_attr( wp_create_nonce( ‘wp_rest’ ) ) ?>”> </form> <script> jQuery.ajax({ beforeSend: function (xhr) { xhr.setRequestHeader(‘X-WP-Nonce’, jQuery(‘form’).find(‘input[name=”rest_auth_nonce”]’).val()); … Read more

Why does AWStats show /wp-json* as Viewed URLs

I’m not entirely sure what will be better explanation, or why this one (the real one) is not enough. In your stats you see URLs of requests and not paths to files. URL has nothing to do with files on server. Yes – if the requests targets physical file, then that file exists, but… There … Read more

REST API GET users

Read the docs: you need to add a Header named X-WP-Nonce to your requests to the API that require authentication, as you can see in the jQuery example. However the catch is getting that nonce in the first place. WordPress inject that token itself in the post editing screens. Type wpApiSettings in the developer console … Read more

Passing a borrowed nonce through Postman fails

For remote apps (cURL, Postman, etc.), or when not using the browser, you should use an authentication plugin like Application Passwords instead of sending the cookies. But if you’d rather send the cookies, then copy and send the WordPress logged-in cookie named wordpress_logged_in_<hash>. Example in cURL: curl -H “X-WP-Nonce: <nonce>” -X POST https://example.com/wp-json/wp/v2/posts -d “Data … Read more

WP 5.5 Fatal Error – get_rest_controller() in rest-api.php

Since 5.5 WP_Taxonomy objects now have a new method, get_rest_controller(), to allow for per-taxonomy controller overrides. The problem is that your plugin overwrites the taxonomy saved in the global $wp_taxonomies cache with a version that isn’t a real WP_Taxonomy object, just a stdObject property bag, and so does not have get_rest_controller() to call. This is … Read more

Using pre_get_posts, how to target the REST API, only?

Yes. So long as the code you’re running happens after parse_request – which pre_get_posts does. (See https://codex.wordpress.org/Plugin_API/Action_Reference#Actions_Run_During_a_Typical_Request) Then you will have a nice constant to use: REST_REQUEST Something like if( defined( ‘REST_REQUEST’ ) && REST_REQUEST ) { // …do RESTy things } will do the trick. See /wp-includes/rest-api.php

WP REST api.wordpress.org discovery

https://api.wordpress.org is a custom PHP API and is not running WordPress. Thus, there’s no WP REST API that you could use for discovery. That URL has nothing to do with the REST API in core except for that redirect to the handbook. Unfortunately not all of the API endpoints are documented or either open sourced, … Read more

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)