Ticket #39881: 39881.2.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -1294 +1294 @@
                 // Can we read the parent if we're inheriting?
                 if ( 'inherit' === $post->post_status && $post->post_parent > 0 ) {
                         $parent = get_post( $post->post_parent );
-                        return $this->check_read_permission( $parent );
+                        if ( $parent ) {
+                                return $this->check_read_permission( $parent );
+                        }
                 }
 
                 /*

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -480 +480 @@
                 $this->assertEquals( 403, $response->get_status() );
         }
 
+        public function test_get_item_inherit_status_with_invalid_parent() {
+                $attachment_id = $this->factory->attachment->create_object( $this->test_file, REST_TESTS_IMPOSSIBLY_HIGH_NUMBER, array(
+                        'post_mime_type' => 'image/jpeg',
+                        'post_excerpt'   => 'A sample caption',
+                ) );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/media/%d', $attachment_id ) );
+                $response = $this->server->dispatch( $request );
+                $data = $response->get_data();
+
+                $this->assertEquals( 200, $response->get_status() );
+                $this->assertEquals( $attachment_id, $data['id'] );
+        }
+
+        public function test_get_item_auto_status_with_invalid_parent_returns_error() {
+                $attachment_id = $this->factory->attachment->create_object( $this->test_file, REST_TESTS_IMPOSSIBLY_HIGH_NUMBER, array(
+                        'post_mime_type' => 'image/jpeg',
+                        'post_excerpt'   => 'A sample caption',
+                        'post_status'    => 'auto-draft',
+                ) );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/media/%d', $attachment_id ) );
+                $response = $this->server->dispatch( $request );
+
+                $this->assertErrorResponse( 'rest_forbidden', $response, 403 );
+        }
+
         public function test_create_item() {
                 wp_set_current_user( self::$author_id );