Ticket #38919: 38919.1.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -973 +973 @@
                 }
 
                 // Post password.
-                if ( ! empty( $schema['properties']['password'] ) && isset( $request['password'] ) && '' !== $request['password'] ) {
+                if ( ! empty( $schema['properties']['password'] ) && isset( $request['password'] ) ) {
                         $prepared_post->post_password = $request['password'];
 
-                        if ( ! empty( $schema['properties']['sticky'] ) && ! empty( $request['sticky'] ) ) {
-                                return new WP_Error( 'rest_invalid_field', __( 'A post can not be sticky and have a password.' ), array( 'status' => 400 ) );
-                        }
+                        if ( '' !== $request['password'] ) {
+                                if ( ! empty( $schema['properties']['sticky'] ) && ! empty( $request['sticky'] ) ) {
+                                        return new WP_Error( 'rest_invalid_field', __( 'A post can not be sticky and have a password.' ), array( 'status' => 400 ) );
+                                }
 
-                        if ( ! empty( $prepared_post->ID ) && is_sticky( $prepared_post->ID ) ) {
-                                return new WP_Error( 'rest_invalid_field', __( 'A sticky post can not be password protected.' ), array( 'status' => 400 ) );
+                                if ( ! empty( $prepared_post->ID ) && is_sticky( $prepared_post->ID ) ) {
+                                        return new WP_Error( 'rest_invalid_field', __( 'A sticky post can not be password protected.' ), array( 'status' => 400 ) );
+                                }
                         }
                 }
 

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -1949 +1949 @@
                 $this->assertEquals( '', $new_data['content']['raw'] );
         }
 
+        public function test_update_post_with_empty_password() {
+                wp_set_current_user( self::$editor_id );
+                wp_update_post( array(
+                        'ID'            => self::$post_id,
+                        'post_password' => 'foo',
+                ) );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+                $params = $this->set_post_data( array(
+                        'password' => '',
+                ) );
+                $request->set_body_params( $params );
+                $response = $this->server->dispatch( $request );
+                $data = $response->get_data();
+                $this->assertEquals( '', $data['password'] );
+        }
+
         public function test_update_post_with_password_and_sticky_fails() {
                 wp_set_current_user( self::$editor_id );