REST API: Prevent inaccessible attachments from being embedded in posts.

When an attachment is used by multiple posts, it could be included in `_embed` for a published post even if its `post_parent` is a draft.

This commit avoids embedding attachments that are not viewable in this context.

Props bor0.

Fixes #64183.
Built from https://develop.svn.wordpress.org/trunk@61996


git-svn-id: http://core.svn.wordpress.org/trunk@61278 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Author: JJJ

wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -2294,7 +2294,7 @@ protected function prepare_links( $post ) {
 
 		// If we have a featured media, add that.
 		$featured_media = get_post_thumbnail_id( $post->ID );
-		if ( $featured_media ) {
+		if ( $featured_media && ( 'publish' === get_post_status( $featured_media ) || current_user_can( 'read_post', $featured_media ) ) ) {
 			$image_url = rest_url( rest_get_route_for_post( $featured_media ) );
 
 			$links['https://api.w.org/featuredmedia'] = array(

wp-includes/version.php

@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.0-beta5-61995';
+$wp_version = '7.0-beta5-61996';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.