Changeset 39288

Timestamp:

11/18/2016 04:55:03 PM (10 years ago)

Author:

rachelbaker

Message:

REST API: On comment create, return an error if the post parameter does not relate to a valid WP_Post object.

Return a WP_Error object for attempts to create a comment without an empty or invalid post ID.

Props dd32, jnylen0, rachelbaker.
Fixes #38816.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-comments-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -386 +386 @@
                 }
 
-                if ( empty( $request['post'] ) && ! current_user_can( 'moderate_comments' ) ) {
-                        return new WP_Error( 'rest_comment_invalid_post_id', __( 'Sorry, you are not allowed to create this comment without a post.' ), array( 'status' => rest_authorization_required_code() ) );
-                }
-
-                if ( ! empty( $request['post'] ) && $post = get_post( (int) $request['post'] ) ) {
-                        if ( 'draft' === $post->post_status ) {
-                                return new WP_Error( 'rest_comment_draft_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
-                        }
-
-                        if ( 'trash' === $post->post_status ) {
-                                return new WP_Error( 'rest_comment_trash_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
-                        }
-
-                        if ( ! $this->check_read_post_permission( $post ) ) {
-                                return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
-                        }
-
-                        if ( ! comments_open( $post->ID ) ) {
-                                return new WP_Error( 'rest_comment_closed', __( 'Sorry, comments are closed on this post.' ), array( 'status' => 403 ) );
-                        }
+                if ( empty( $request['post'] ) ) {
+                        return new WP_Error( 'rest_comment_invalid_post_id', __( 'Sorry, you are not allowed to create this comment without a post.' ), array( 'status' => 403 ) );
+                }
+
+                $post = get_post( (int) $request['post'] );
+                if ( ! $post ) {
+                        return new WP_Error( 'rest_comment_invalid_post_id', __( 'Sorry, you are not allowed to create this comment without a post.' ), array( 'status' => 403 ) );
+                }
+
+                if ( 'draft' === $post->post_status ) {
+                        return new WP_Error( 'rest_comment_draft_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
+                }
+
+                if ( 'trash' === $post->post_status ) {
+                        return new WP_Error( 'rest_comment_trash_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
+                }
+
+                if ( ! $this->check_read_post_permission( $post ) ) {
+                        return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
+                }
+
+                if ( ! comments_open( $post->ID ) ) {
+                        return new WP_Error( 'rest_comment_closed', __( 'Sorry, comments are closed on this post.' ), array( 'status' => 403 ) );
                 }
 

trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -1307 +1307 @@
 
                 $response = $this->server->dispatch( $request );
-                $this->assertEquals( 201, $response->get_status() );
+
+                $this->assertErrorResponse( 'rest_comment_invalid_post_id', $response, 403 );
         }