WordPress Users API throwing 403 Forbidden error - Hack The Tech - Latest News related to Computer and Technology

Hack The Tech - Latest News related to Computer and Technology

Get Daily Latest News related to Computer and Technology and hack the world.

Monday, July 10, 2023

WordPress Users API throwing 403 Forbidden error

I have an personal website in WordPress, recently I upgrade my WordPress version to 6.2.2.

Its decoupled site, frontend in react & WordPress rest API I am using to populate post on my site.

After upgrading to 6.2.2 User API stopped working & throwing 403 forbidden error.

I am using Application Password to login & generate my JWT Token using JWT Authentication for WP-API plugin.

All other API's where login required, those are working fine apart from user API (/wp-json/wp/v2/users/1).

I don't have any firewall installed as of now, I have only light speed plugin enabled.

I tried with disabling all the plugins but still no luck.

After dig down to core WP I found below code where WP is looking for role wise permission, if anyone know about it please help me.

/**
 * Permissions check for getting all users.
 *
 * @since 4.7.0
 *
 * @param WP_REST_Request $request Full details about the request.
 * @return true|WP_Error True if the request has read access, otherwise WP_Error object.
 */
public function get_items_permissions_check( $request ) {
    // Check if roles is specified in GET request and if user can list users.
    if ( ! empty( $request['roles'] ) && ! current_user_can( 'list_users' ) ) {
        return new WP_Error(
            'rest_user_cannot_view',
            __( 'Sorry, you are not allowed to filter users by role.' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }

    // Check if capabilities is specified in GET request and if user can list users.
    if ( ! empty( $request['capabilities'] ) && ! current_user_can( 'list_users' ) ) {
        return new WP_Error(
            'rest_user_cannot_view',
            __( 'Sorry, you are not allowed to filter users by capability.' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }

    if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
        return new WP_Error(
            'rest_forbidden_context',
            __( 'Sorry, you are not allowed to list users.' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }

    if ( in_array( $request['orderby'], array( 'email', 'registered_date' ), true ) && ! current_user_can( 'list_users' ) ) {
        return new WP_Error(
            'rest_forbidden_orderby',
            __( 'Sorry, you are not allowed to order users by this parameter.' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }

    if ( 'authors' === $request['who'] ) {
        $types = get_post_types( array( 'show_in_rest' => true ), 'objects' );

        foreach ( $types as $type ) {
            if ( post_type_supports( $type->name, 'author' )
                && current_user_can( $type->cap->edit_posts ) ) {
                return true;
            }
        }

        return new WP_Error(
            'rest_forbidden_who',
            __( 'Sorry, you are not allowed to query users by this parameter.' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }

    return true;
}


source https://stackoverflow.com/questions/76644675/wordpress-users-api-throwing-403-forbidden-error

No comments:

Post a Comment