Ticket #47024: 47024.2.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -1672 +1672 @@
                         return false;
                 }
 
-                if ( ! current_user_can( 'moderate_comments' ) ) {
-                        return false;
+                if ( current_user_can( 'moderate_comments' ) ) {
+                        return true;
                 }
 
                 return current_user_can( 'edit_comment', $comment->comment_ID );

tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -2480 +2480 @@
                 $this->assertErrorResponse( 'rest_cannot_edit', $response, 401 );
         }
 
+        /**
+         * @ticket 47024
+         *
+         * @todo flip logic to test for 200 if #41037 is addressed.
+         */
+        public function test_update_comment_when_comment_author_but_not_post_author() {
+                wp_set_current_user( self::$author_id );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/comments/%d', self::$approved_id ) );
+                $params  = array(
+                        'content' => 'Updated comment.',
+                        'date'    => '2019-10-07T23:14:25',
+                );
+                $request->add_header( 'content-type', 'application/json' );
+                $request->set_body( wp_json_encode( $params ) );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_edit', $response, 403 );
+        }
+
+        /**
+         * @ticket 47024
+         */
+        public function test_update_comment_when_can_manage_comments() {
+                wp_set_current_user( self::$editor_id );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/comments/%d', self::$approved_id ) );
+                $params  = array(
+                        'content' => 'Updated comment.',
+                        'date'    => '2019-10-07T23:14:25',
+                );
+                $request->add_header( 'content-type', 'application/json' );
+                $request->set_body( wp_json_encode( $params ) );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $comment = $response->get_data();
+                $updated = get_comment( self::$approved_id );
+
+                $this->assertEquals( $params['content'], $comment['content']['raw'] );
+                $this->assertEquals( self::$post_id, $comment['post'] );
+                $this->assertEquals( mysql_to_rfc3339( $updated->comment_date ), $comment['date'] );
+                $this->assertEquals( '2019-10-07T23:14:25', $comment['date'] );
+        }
+
         public function test_update_comment_private_post_invalid_permission() {
                 $private_comment_id = $this->factory->comment->create(
                         array(