Ticket #47443: 47443.2.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -1161 +1161 @@
                                 }
                                 break;
                         case 'publish':
-                        case 'future':
                                 if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
                                         return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to publish posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );
                                 }
                                 break;
+                        case 'future':
+                                if ( ! current_user_can( $post_type->cap->publish_posts ) && ! current_user_can( $post_type->cap->edit_published_posts ) ) {
+                                        return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to publish posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );
+                                }
+                                break;
                         default:
                                 if ( ! get_post_status_object( $post_status ) ) {
                                         $post_status = 'draft';
@@ -1852 +1856 @@
 
                 $post_type = get_post_type_object( $post->post_type );
 
-                if ( 'attachment' !== $this->post_type && current_user_can( $post_type->cap->publish_posts ) ) {
+                if ( 'attachment' !== $this->post_type && ( ( 'publish' == $post->post_status && current_user_can( $post_type->cap->edit_published_posts ) ) || current_user_can( $post_type->cap->publish_posts ) ) ) {
                         $rels[] = 'https://api.w.org/action-publish';
                 }
 

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -4841 +4841 @@
                 $this->assertNull( get_post_type_object( 'test' )->get_rest_controller() );
         }
 
+        /**
+         * @ticket 47443
+         */
+        public function test_edit_published_post_without_publish_posts_capability() {
+                wp_set_current_user( self::$editor_id );
+                $user = wp_get_current_user();
+                $user->add_cap( 'publish_posts', false );
+                $user->add_cap( 'edit_published_posts', true );
+
+                // Flush capabilities, https://core.trac.wordpress.org/ticket/28374
+                $user->get_role_caps();
+                $user->update_user_level_from_caps();
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+                $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $params = $this->set_post_data( array(
+                        'title'   => 'Hello World',
+                        'content' => 'Hello, world.',
+                        'excerpt' => 'Hello',
+                        'name'    => 'test',
+                        'status'  => 'future',
+                        'author'  => get_current_user_id(),
+                        'type'    => 'post',
+                ) );
+
+                $request->set_body_params( $params );
+                $response = rest_get_server()->dispatch( $request );
+                $this->check_update_post_response( $response );
+                $new_data = $response->get_data();
+
+                $this->assertEquals( self::$post_id, $new_data['id'] );
+                $this->assertEquals( $params['title'], $new_data['title']['raw'] );
+                $this->assertEquals( $params['content'], $new_data['content']['raw'] );
+                $this->assertEquals( $params['excerpt'], $new_data['excerpt']['raw'] );
+                $post = get_post( self::$post_id );
+                $this->assertEquals( 'Hello World', $post->post_title );
+                $this->assertEquals( 'Hello, world.', $post->post_content );
+                $this->assertEquals( 'Hello', $post->post_excerpt );
+
+                $request2 = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+                $request2->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $params2 = $this->set_post_data( array(
+                        'content' => 'Hello again.',
+                        'status'  => 'future',
+                ) );
+                $request2->set_body_params( $params2 );
+                $response2 = rest_get_server()->dispatch( $request2 );
+                $this->check_update_post_response( $response2 );
+                $data2 = $response2->get_data();
+                $post2 = get_post( self::$post_id );
+                $this->assertEquals( 'Hello again.', $post2->post_content );
+        }
+
         public function tearDown() {
                 _unregister_post_type( 'private-post' );
                 _unregister_post_type( 'youseeme' );