Ticket #48764: 48764.1.patch

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -959 +959 @@
          * @return stdClass|WP_Error Post object or WP_Error.
          */
         protected function prepare_item_for_database( $request ) {
-                $prepared_post = new stdClass;
+                $prepared_post = new stdClass();
 
                 // Post ID.
                 if ( isset( $request['id'] ) ) {
@@ -1013 +1013 @@
 
                 // Post status.
                 if ( ! empty( $schema['properties']['status'] ) && isset( $request['status'] ) ) {
-                        $status = $this->handle_status_param( $request['status'], $post_type );
+                        $status = $this->handle_status_param( $request['status'], $post_type, $request['id'] );
 
                         if ( is_wp_error( $status ) ) {
                                 return $status;
@@ -1147 +1147 @@
          *
          * @param string $post_status Post status.
          * @param object $post_type   Post type.
+         * @param int    $post_id     Post ID.
          * @return string|WP_Error Post status or WP_Error if lacking the proper permission.
          */
-        protected function handle_status_param( $post_status, $post_type ) {
+        protected function handle_status_param( $post_status, $post_type, $post_id ) {
 
                 switch ( $post_status ) {
                         case 'draft':
@@ -1156 +1157 @@
                         case 'pending':
                                 break;
                         case 'private':
-                                if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
+                                if ( ! current_user_can( $post_type->cap->publish_posts, $post_id ) ) {
                                         return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to create private posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );
                                 }
                                 break;
                         case 'publish':
                         case 'future':
-                                if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
+                                if ( ! current_user_can( $post_type->cap->publish_posts, $post_id ) ) {
                                         return new WP_Error( 'rest_cannot_publish', __( 'Sorry, you are not allowed to publish posts in this post type.' ), array( 'status' => rest_authorization_required_code() ) );
                                 }
                                 break;
@@ -2078 +2079 @@
                                                 'type'        => 'object',
                                                 'context'     => array( 'view', 'edit', 'embed' ),
                                                 'arg_options' => array(
-                                                        'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database()
-                                                        'validate_callback' => null, // Note: validation implemented in self::prepare_item_for_database()
+                                                        'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database().
+                                                        'validate_callback' => null, // Note: validation implemented in self::prepare_item_for_database().
                                                 ),
                                                 'properties'  => array(
                                                         'raw'      => array(
@@ -2103 +2104 @@
                                                 'type'        => 'object',
                                                 'context'     => array( 'view', 'edit' ),
                                                 'arg_options' => array(
-                                                        'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database()
-                                                        'validate_callback' => null, // Note: validation implemented in self::prepare_item_for_database()
+                                                        'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database().
+                                                        'validate_callback' => null, // Note: validation implemented in self::prepare_item_for_database().
                                                 ),
                                                 'properties'  => array(
                                                         'raw'           => array(
@@ -2148 +2149 @@
                                                 'type'        => 'object',
                                                 'context'     => array( 'view', 'edit', 'embed' ),
                                                 'arg_options' => array(
-                                                        'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database()
-                                                        'validate_callback' => null, // Note: validation implemented in self::prepare_item_for_database()
+                                                        'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database().
+                                                        'validate_callback' => null, // Note: validation implemented in self::prepare_item_for_database().
                                                 ),
                                                 'properties'  => array(
                                                         'raw'       => array(
@@ -2606 +2607 @@
         public function sanitize_post_statuses( $statuses, $request, $parameter ) {
                 $statuses = wp_parse_slug_list( $statuses );
 
-                // The default status is different in WP_REST_Attachments_Controller
+                // The default status is different in WP_REST_Attachments_Controller.
                 $attributes     = $request->get_attributes();
                 $default_status = $attributes['args']['status']['default'];