Ticket #43701: 43701.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -2291 +2291 @@
 
                         $post_type_obj = get_post_type_object( $this->post_type );
 
-                        if ( current_user_can( $post_type_obj->cap->edit_posts ) ) {
+                        if ( current_user_can( $post_type_obj->cap->edit_posts ) || current_user_can( $post_type_obj->cap->read_private_posts ) ) {
                                 $result = rest_validate_request_arg( $status, $request, $parameter );
                                 if ( is_wp_error( $result ) ) {
                                         return $result;

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -617 +617 @@
                 }
         }
 
+        /**
+         * @ticket 43701
+         */
+        public function test_get_items_status_private_without_edit_capability() {
+                $this->factory->post->create( array( 'post_status' => 'private' ) );
+
+                wp_set_current_user( 0 );
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+                $request->set_param( 'status', 'private' );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+
+                add_role( 'wp_test_role_read_private', 'Paid Subscriber', array( 'read_private_posts' => true ) );
+
+                $user_id = $this->factory->user->create(
+                        array(
+                                'role' => 'wp_test_role_read_private',
+                        )
+                );
+
+                wp_set_current_user( $user_id );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+                $request->set_param( 'status', 'private' );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+                $this->assertEquals( 1, count( $response->get_data() ) );
+        }
+
         public function test_get_items_order_and_orderby() {
                 $this->factory->post->create(
                         array(