Changeset 39288

Timestamp:

11/18/2016 04:55:03 PM (8 years ago)

Author:

rachelbaker

Message:

REST API: On comment create, return an error if the post parameter does not relate to a valid WP_Post object.

Return a WP_Error object for attempts to create a comment without an empty or invalid post ID.

Props dd32, jnylen0, rachelbaker.
Fixes #38816.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-comments-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -386 +386 @@
         }
 
-        if ( empty( $request['post'] ) && ! current_user_can( 'moderate_comments' ) ) {
-            return new WP_Error( 'rest_comment_invalid_post_id', __( 'Sorry, you are not allowed to create this comment without a post.' ), array( 'status' => rest_authorization_required_code() ) );
-        }
-
-        if ( ! empty( $request['post'] ) && $post = get_post( (int) $request['post'] ) ) {
-            if ( 'draft' === $post->post_status ) {
-                return new WP_Error( 'rest_comment_draft_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
-            }
-
-            if ( 'trash' === $post->post_status ) {
-                return new WP_Error( 'rest_comment_trash_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
-            }
-
-            if ( ! $this->check_read_post_permission( $post ) ) {
-                return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
-            }
-
-            if ( ! comments_open( $post->ID ) ) {
-                return new WP_Error( 'rest_comment_closed', __( 'Sorry, comments are closed on this post.' ), array( 'status' => 403 ) );
-            }
+        if ( empty( $request['post'] ) ) {
+            return new WP_Error( 'rest_comment_invalid_post_id', __( 'Sorry, you are not allowed to create this comment without a post.' ), array( 'status' => 403 ) );
+        }
+
+        $post = get_post( (int) $request['post'] );
+        if ( ! $post ) {
+            return new WP_Error( 'rest_comment_invalid_post_id', __( 'Sorry, you are not allowed to create this comment without a post.' ), array( 'status' => 403 ) );
+        }
+
+        if ( 'draft' === $post->post_status ) {
+            return new WP_Error( 'rest_comment_draft_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
+        }
+
+        if ( 'trash' === $post->post_status ) {
+            return new WP_Error( 'rest_comment_trash_post', __( 'Sorry, you are not allowed to create a comment on this post.' ), array( 'status' => 403 ) );
+        }
+
+        if ( ! $this->check_read_post_permission( $post ) ) {
+            return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
+        }
+
+        if ( ! comments_open( $post->ID ) ) {
+            return new WP_Error( 'rest_comment_closed', __( 'Sorry, comments are closed on this post.' ), array( 'status' => 403 ) );
         }
 

trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -1307 +1307 @@
 
         $response = $this->server->dispatch( $request );
-        $this->assertEquals( 201, $response->get_status() );
+
+        $this->assertErrorResponse( 'rest_comment_invalid_post_id', $response, 403 );
     }