Changeset 34570 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

09/26/2015 02:48:47 AM (11 years ago)

Author:

wonderboymusic

Message:

XML-RPC: wp.getComments should be allowed to return approved comments to those without the 'moderate_comments' cap.

Adds (rewrites) unit tests from 4 years ago that we never committed because....

Props wonderboymusic, koke, ericmann, nprasath002.
Fixes #17981.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (9 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3156 +3156 @@
                 $comment_id     = (int) $args[3];
 
-                if ( !$user = $this->login($username, $password) )
-                        return $this->error;
-
-                if ( !current_user_can( 'moderate_comments' ) )
-                        return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
+                if ( ! $user = $this->login( $username, $password ) ) {
+                        return $this->error;
+                }
 
                 /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
                 do_action( 'xmlrpc_call', 'wp.getComment' );
 
-                if ( ! $comment = get_comment($comment_id) )
+                if ( ! $comment = get_comment( $comment_id ) ) {
                         return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
+                }
+
+                if ( ! current_user_can( 'edit_comment', $comment_id ) ) {
+                        return new IXR_Error( 403, __( 'You are not allowed to moderate or edit this comment.' ) );
+                }
 
                 return $this->_prepare_comment( $comment );
@@ -3204 +3207 @@
                 $struct   = isset( $args[3] ) ? $args[3] : array();
 
-                if ( !$user = $this->login($username, $password) )
-                        return $this->error;
-
-                if ( !current_user_can( 'moderate_comments' ) )
-                        return new IXR_Error( 401, __( 'Sorry, you cannot edit comments.' ) );
+                if ( ! $user = $this->login($username, $password ) )
+                        return $this->error;
 
                 /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
                 do_action( 'xmlrpc_call', 'wp.getComments' );
 
-                if ( isset($struct['status']) )
+                if ( isset( $struct['status'] ) )
                         $status = $struct['status'];
                 else
                         $status = '';
+
+                if ( ! current_user_can( 'moderate_comments' ) && 'approve' !== $status ) {
+                        return new IXR_Error( 401, __( 'Invalid comment status.' ) );
+                }
 
                 $post_id = '';
@@ -3261 +3265 @@
          * @return bool|IXR_Error {@link wp_delete_comment()}
          */
-        public function wp_deleteComment($args) {
+        public function wp_deleteComment( $args ) {
                 $this->escape($args);
 
@@ -3268 +3272 @@
                 $comment_ID     = (int) $args[3];
 
-                if ( !$user = $this->login($username, $password) )
-                        return $this->error;
-
-                if ( !current_user_can( 'moderate_comments' ) )
-                        return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
-
-                if ( ! get_comment($comment_ID) )
+                if ( ! $user = $this->login( $username, $password ) ) {
+                        return $this->error;
+                }
+
+                if ( ! get_comment( $comment_ID ) ) {
                         return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
-
-                if ( !current_user_can( 'edit_comment', $comment_ID ) )
-                        return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
+                }
+
+                if ( !current_user_can( 'edit_comment', $comment_ID ) ) {
+                        return new IXR_Error( 403, __( 'You are not allowed to moderate or edit this comment.' ) );
+                }
 
                 /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
@@ -3335 +3339 @@
                 $content_struct = $args[4];
 
-                if ( !$user = $this->login($username, $password) )
-                        return $this->error;
-
-                if ( !current_user_can( 'moderate_comments' ) )
-                        return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
-
-                if ( ! get_comment($comment_ID) )
+                if ( !$user = $this->login( $username, $password ) ) {
+                        return $this->error;
+                }
+
+                if ( ! get_comment( $comment_ID ) ) {
                         return new IXR_Error( 404, __( 'Invalid comment ID.' ) );
-
-                if ( !current_user_can( 'edit_comment', $comment_ID ) )
-                        return new IXR_Error( 403, __( 'You are not allowed to moderate comments on this site.' ) );
+                }
+
+                if ( ! current_user_can( 'edit_comment', $comment_ID ) ) {
+                        return new IXR_Error( 403, __( 'You are not allowed to moderate or edit this comment.' ) );
+                }
 
                 /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
@@ -3537 +3541 @@
          * @return array|IXR_Error
          */
-        public function wp_getCommentStatusList($args) {
+        public function wp_getCommentStatusList( $args ) {
                 $this->escape( $args );
 
@@ -3543 +3547 @@
                 $password = $args[2];
 
-                if ( !$user = $this->login($username, $password) )
-                        return $this->error;
-
-                if ( !current_user_can( 'moderate_comments' ) )
+                if ( ! $user = $this->login( $username, $password ) ) {
+                        return $this->error;
+                }
+
+                if ( ! current_user_can( 'publish_posts' ) ) {
                         return new IXR_Error( 403, __( 'You are not allowed access to details about this site.' ) );
+                }
 
                 /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
@@ -3577 +3583 @@
                 $post_id        = (int) $args[3];
 
-                if ( !$user = $this->login($username, $password) )
-                        return $this->error;
-
-                if ( !current_user_can( 'edit_posts' ) )
-                        return new IXR_Error( 403, __( 'You are not allowed access to details about comments.' ) );
+                if ( ! $user = $this->login( $username, $password ) ) {
+                        return $this->error;
+                }
+
+                $post = get_post( $post_id, ARRAY_A );
+                if ( empty( $post['ID'] ) ) {
+                        return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+                }
+
+                if ( ! current_user_can( 'edit_post', $post_id ) ) {
+                        return new IXR_Error( 403, __( 'You are not allowed access to details of this post.' ) );
+                }
 
                 /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
@@ -3587 +3600 @@
 
                 $count = wp_count_comments( $post_id );
+
                 return array(
                         'approved' => $count->approved,