Check user can edit post meta

WordPress · May 17, 2024 · b1a5a81 · b1a5a81
1 parent 1b30f16
commit b1a5a81
Showing 1 changed file with 17 additions and 2 deletions.
diff --git a/packages/editor/src/bindings/post-meta.js b/packages/editor/src/bindings/post-meta.js
@@ -37,12 +37,27 @@ export default {
 				},
 			} );
 	},
-	lockAttributesEditing() {
+	lockAttributesEditing( { select, context = {} } ) {
+		const postId = context.postId
+			? context.postId
+			: select( editorStore ).getCurrentPostId();
+		const postType = context.postType
+			? context.postType
+			: select( editorStore ).getCurrentPostType();
+
 		// TODO: Check that editing is happening in the post editor and not a template.
 
 		// TODO: Check that the custom field is not protected and available in the REST API.
 
-		// TODO: Check that the user has the capability to edit post meta.
+		// Check that the user has the capability to edit post meta.
+		const canUserEdit = select( coreDataStore ).canUserEditEntityRecord(
+			'postType',
+			postType,
+			postId
+		);
+		if ( ! canUserEdit ) {
+			return true;
+		}
 
 		return false;
 	},