Ticket #38820: 38820.2.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -430 +430 @@
                         return $prepared_comment;
                 }
 
+                // Do not allow comments to be created with non-whitelisted type.
+                if ( ! empty( $request['type'] ) && ! in_array( $request['type'], array( 'comment', 'pingback', 'trackback' ) ) ) {
+                        return new WP_Error( 'rest_invalid_comment_type', __( 'Cannot create a comment with that type.' ), array( 'status' => 400 ) );
+                }
+
                 /*
                  * Do not allow a comment to be created with missing or empty
                  * comment_content. See wp_handle_comment_submission().

tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -1034 +1034 @@
                 $this->assertEquals( $comment_id, $collection_data[0]['id'] );
         }
 
+        /**
+         * @ticket 38820
+         */
+        public function test_create_comment_with_invalid_type() {
+                $post_id = $this->factory->post->create();
+                wp_set_current_user( self::$admin_id );
+
+                $params = array(
+                        'post'    => $post_id,
+                        'author'       => self::$admin_id,
+                        'author_name'  => 'Comic Book Guy',
+                        'author_email' => 'cbg@androidsdungeon.com',
+                        'author_url'   => 'http://androidsdungeon.com',
+                        'content' => 'Worst Comment Ever!',
+                        'date'    => '2014-11-07T10:14:25',
+                        'type' => 'foo',
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/comments' );
+                $request->add_header( 'content-type', 'application/json' );
+                $request->set_body( wp_json_encode( $params ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_invalid_comment_type', $response, 400 );
+        }
+
         public function test_create_comment_invalid_email() {
                 $post_id = $this->factory->post->create();
                 wp_set_current_user( self::$admin_id );