Ticket #43701: 43701.2.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -2489 +2489 @@
 
                         $post_type_obj = get_post_type_object( $this->post_type );
 
-                        if ( current_user_can( $post_type_obj->cap->edit_posts ) ) {
+                        if ( current_user_can( $post_type_obj->cap->edit_posts ) || 'private' === $status && current_user_can( $post_type_obj->cap->read_private_posts ) ) {
                                 $result = rest_validate_request_arg( $status, $request, $parameter );
                                 if ( is_wp_error( $result ) ) {
                                         return $result;

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -16 +16 @@
         protected static $editor_id;
         protected static $author_id;
         protected static $contributor_id;
+        protected static $private_reader_id;
 
         protected static $supported_formats;
 
@@ -47 +48 @@
                         )
                 );
 
+                self::$private_reader_id = $factory->user->create(
+                        array(
+                                'role' => 'private_reader',
+                        )
+                );
+
                 if ( is_multisite() ) {
                         update_site_option( 'site_admins', array( 'superadmin' ) );
                 }
@@ -70 +77 @@
                 self::delete_user( self::$editor_id );
                 self::delete_user( self::$author_id );
                 self::delete_user( self::$contributor_id );
+                self::delete_user( self::$private_reader_id );
         }
 
         public function setUp() {
@@ -81 +89 @@
                                 'show_in_rest' => true,
                         )
                 );
+
+                add_role( 'private_reader', 'Private Reader' );
+                $role = get_role( 'private_reader' );
+                $role->add_cap( 'read_private_posts' );
+
                 add_filter( 'rest_pre_dispatch', array( $this, 'wpSetUpBeforeRequest' ), 10, 3 );
                 add_filter( 'posts_clauses', array( $this, 'save_posts_clauses' ), 10, 2 );
         }
@@ -592 +605 @@
                 $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
         }
 
+        /**
+         * @ticket 43701
+         */
+        public function test_get_items_multiple_statuses_custom_role_one_invalid_query() {
+                $private_post_id = $this->factory->post->create( array( 'post_status' => 'private' ) );
+
+                wp_set_current_user( self::$private_reader_id );
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+                $request->set_param( 'status', array( 'private', 'future' ) );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+        }
+
         public function test_get_items_invalid_status_query() {
                 wp_set_current_user( 0 );
                 $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
@@ -1194 +1221 @@
                 $this->assertContains( '<' . $next_link . '>; rel="next"', $headers['Link'] );
         }
 
-        public function test_get_items_private_status_query_var() {
-                // Private query vars inaccessible to unauthorized users
+        public function test_get_items_status_draft_permissions() {
+                $draft_id = $this->factory->post->create( array( 'post_status' => 'draft' ) );
+
+                // Drafts status query var inaccessible to unauthorized users.
                 wp_set_current_user( 0 );
-                $draft_id = $this->factory->post->create( array( 'post_status' => 'draft' ) );
                 $request  = new WP_REST_Request( 'GET', '/wp/v2/posts' );
                 $request->set_param( 'status', 'draft' );
                 $response = rest_get_server()->dispatch( $request );
                 $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
 
-                // But they are accessible to authorized users
+                // Users with 'read_private_posts' cap shouldn't also be able to view drafts.
+                wp_set_current_user( self::$private_reader_id );
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+                $request->set_param( 'status', 'draft' );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+
+                // But drafts are accessible to authorized users.
                 wp_set_current_user( self::$editor_id );
                 $response = rest_get_server()->dispatch( $request );
                 $data     = $response->get_data();
@@ -1211 +1246 @@
                 $this->assertEquals( $draft_id, $data[0]['id'] );
         }
 
+        /**
+         * @ticket 43701
+         */
+        public function test_get_items_status_private_permissions() {
+                $private_post_id = $this->factory->post->create( array( 'post_status' => 'private' ) );
+
+                wp_set_current_user( 0 );
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+                $request->set_param( 'status', 'private' );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+
+                wp_set_current_user( self::$private_reader_id );
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+                $request->set_param( 'status', 'private' );
+
+                $response = rest_get_server()->dispatch( $request );
+                $data     = $response->get_data();
+                $this->assertEquals( 200, $response->get_status() );
+                $this->assertCount( 1, $data );
+                $this->assertEquals( $private_post_id, $data[0]['id'] );
+        }
+
         public function test_get_items_invalid_per_page() {
                 $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
                 $request->set_query_params( array( 'per_page' => -1 ) );