Ticket #38692: 38692.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -108 +108 @@
                         foreach ( (array) $request['post'] as $post_id ) {
                                 $post = get_post( $post_id );
 
-                                if ( ! empty( $post_id ) && $post && ! $this->check_read_post_permission( $post ) ) {
+                                if ( ! empty( $post_id ) && $post && ! $this->check_read_post_permission( $post, $request ) ) {
                                         return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
                                 } elseif ( 0 === $post_id && ! current_user_can( 'moderate_comments' ) ) {
                                         return new WP_Error( 'rest_cannot_read', __( 'Sorry, you are not allowed to read comments without a post.' ), array( 'status' => rest_authorization_required_code() ) );
@@ -242 +242 @@
                 $comments = array();
 
                 foreach ( $query_result as $comment ) {
-                        if ( ! $this->check_read_permission( $comment ) ) {
+                        if ( ! $this->check_read_permission( $comment, $request ) ) {
                                 continue;
                         }
 
@@ -309 +309 @@
                         return true;
                 }
 
-                if ( ! $this->check_read_permission( $comment ) ) {
-                        return new WP_Error( 'rest_cannot_read', __( 'Sorry, you are not allowed to read this comment.' ), array( 'status' => rest_authorization_required_code() ) );
+                if ( ! empty( $request['context'] ) && 'edit' === $request['context'] && ! current_user_can( 'moderate_comments' ) ) {
+                        return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit comments.' ), array( 'status' => rest_authorization_required_code() ) );
                 }
 
                 $post = get_post( $comment->comment_post_ID );
 
-                if ( $post && ! $this->check_read_post_permission( $post ) ) {
-                        return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
+                if ( ! $this->check_read_permission( $comment, $request ) ) {
+                        return new WP_Error( 'rest_cannot_read', __( 'Sorry, you are not allowed to read this comment.' ), array( 'status' => rest_authorization_required_code() ) );
                 }
 
-                if ( ! empty( $request['context'] ) && 'edit' === $request['context'] && ! current_user_can( 'moderate_comments' ) ) {
-                        return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit comments.' ), array( 'status' => rest_authorization_required_code() ) );
+                if ( $post && ! $this->check_read_post_permission( $post, $request ) ) {
+                        return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
                 }
 
                 return true;
@@ -433 +433 @@
                         return new WP_Error( 'rest_comment_trash_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
                 }
 
-                if ( ! $this->check_read_post_permission( $post ) ) {
+                if ( ! $this->check_read_post_permission( $post, $request ) ) {
                         return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
                 }
 
@@ -1488 +1488 @@
          * @since 4.7.0
          * @access protected
          *
-         * @param WP_Post $post Post Object.
+         * @param WP_Post         $post    Post object.
+         * @param WP_REST_Request $request Request data to check.
          * @return bool Whether post can be read.
          */
-        protected function check_read_post_permission( $post ) {
+        protected function check_read_post_permission( $post, $request ) {
                 $posts_controller = new WP_REST_Posts_Controller( $post->post_type );
                 $post_type = get_post_type_object( $post->post_type );
 
+                $has_password_filter = false;
+
+                if ( $posts_controller->can_access_password_content( $post, $request ) ) {
+                        add_filter( 'post_password_required', '__return_false' );
+
+                        $has_password_filter = true;
+                }
+
                 if ( post_password_required( $post ) ) {
-                        return current_user_can( $post_type->cap->edit_post, $post->ID );
+                        $result = current_user_can( $post_type->cap->edit_post, $post->ID );
+                } else {
+                        $result = $posts_controller->check_read_permission( $post );
                 }
 
-                return $posts_controller->check_read_permission( $post );
+                if ( $has_password_filter ) {
+                        remove_filter( 'post_password_required', '__return_false' );
+                }
+
+                return $result;
         }
 
         /**
@@ -1508 +1523 @@
          * @since 4.7.0
          * @access protected
          *
-         * @param WP_Comment $comment Comment object.
+         * @param WP_Comment      $comment Comment object.
+         * @param WP_REST_Request $request Request data to check.
          * @return bool Whether the comment can be read.
          */
-        protected function check_read_permission( $comment ) {
+        protected function check_read_permission( $comment, $request ) {
                 if ( ! empty( $comment->comment_post_ID ) ) {
                         $post = get_post( $comment->comment_post_ID );
                         if ( $post ) {
-                                if ( $this->check_read_post_permission( $post ) && 1 === (int) $comment->comment_approved ) {
+                                if ( $this->check_read_post_permission( $post, $request ) && 1 === (int) $comment->comment_approved ) {
                                         return true;
                                 }
                         }

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -383 +383 @@
          * check in core with a filter.
          *
          * @since 4.7.0
-         * @access protected
+         * @access public
          *
          * @param WP_Post         $post    Post to check against.
          * @param WP_REST_Request $request Request data to check.
          * @return bool True if the user can access password-protected content, otherwise false.
          */
-        protected function can_access_password_content( $post, $request ) {
+        public function can_access_password_content( $post, $request ) {
                 if ( empty( $post->post_password ) ) {
                         // No filter required.
                         return false;