Changeset 39295

Timestamp:

11/18/2016 07:06:26 PM (8 years ago)

Author:

joehoyle

Message:

REST API: Check read permissions on posts when viewing comments.

With a few tests for getting / creating comments to reflect core behaviour.

Props timmyc.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-comments-controller.php (modified) (6 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -1455 +1455 @@
     protected function check_read_post_permission( $post ) {
         $posts_controller = new WP_REST_Posts_Controller( $post->post_type );
+        $post_type = get_post_type_object( $post->post_type );
+
+        if ( post_password_required( $post ) ) {
+            return current_user_can( $post_type->cap->edit_post, $post->ID );
+        }
 
         return $posts_controller->check_read_permission( $post );

trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -18 +18 @@
 
     protected static $post_id;
+    protected static $password_id;
     protected static $private_id;
     protected static $draft_id;
@@ -53 +54 @@
             'post_status' => 'private',
         ) );
+        self::$password_id = $factory->post->create( array(
+            'post_password'    => 'toomanysecrets',
+        ) );
         self::$draft_id = $factory->post->create( array(
             'post_status' => 'draft',
@@ -79 +83 @@
         wp_delete_post( self::$post_id, true );
         wp_delete_post( self::$private_id, true );
+        wp_delete_post( self::$password_id, true );
         wp_delete_post( self::$draft_id, true );
         wp_delete_post( self::$trash_id, true );
@@ -163 +168 @@
     }
 
+    public function test_get_password_items_without_edit_post_permission() {
+        wp_set_current_user( 0 );
+
+        $args = array(
+            'comment_approved' => 1,
+            'comment_post_ID'  => self::$password_id,
+        );
+        $password_comment = $this->factory->comment->create( $args );
+
+        $request = new WP_REST_Request( 'GET', '/wp/v2/comments' );
+
+        $response = $this->server->dispatch( $request );
+        $this->assertEquals( 200, $response->get_status() );
+
+        $collection_data = $response->get_data();
+        $this->assertFalse( in_array( $password_comment, wp_list_pluck( $collection_data, 'id' ), true ) );
+    }
+
+    public function test_get_password_items_with_edit_post_permission() {
+        wp_set_current_user( self::$admin_id );
+
+        $args = array(
+            'comment_approved' => 1,
+            'comment_post_ID'  => self::$password_id,
+        );
+        $password_comment = $this->factory->comment->create( $args );
+
+        $request = new WP_REST_Request( 'GET', '/wp/v2/comments' );
+
+        $response = $this->server->dispatch( $request );
+        $this->assertEquals( 200, $response->get_status() );
+
+        $collection_data = $response->get_data();
+        $this->assertTrue( in_array( $password_comment, wp_list_pluck( $collection_data, 'id' ), true ) );
+    }
+
     public function test_get_items_without_private_post_permission() {
         wp_set_current_user( 0 );
@@ -801 +842 @@
     }
 
+    public function test_get_comment_with_password_without_edit_post_permission() {
+        wp_set_current_user( 0 );
+        $args = array(
+            'comment_approved' => 1,
+            'comment_post_ID'  => self::$password_id,
+        );
+        $password_comment = $this->factory->comment->create( $args );
+        $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%s', $password_comment ) );
+        $response = $this->server->dispatch( $request );
+        $this->assertErrorResponse( 'rest_cannot_read', $response, 401 );
+    }
+
     public function test_create_item() {
         wp_set_current_user( 0 );
@@ -1370 +1423 @@
         $response = $this->server->dispatch( $request );
 
+        $this->assertErrorResponse( 'rest_cannot_read_post', $response, 403 );
+    }
+
+    public function test_create_comment_password_post_invalid_permission() {
+        wp_set_current_user( self::$subscriber_id );
+
+        $params = array(
+            'post'         => self::$password_id,
+            'author_name'  => 'Homer Jay Simpson',
+            'author_email' => 'chunkylover53@aol.com',
+            'author_url'   => 'http://compuglobalhypermeganet.com',
+            'content'      => 'I\’d be a vegetarian if bacon grew on trees.',
+            'author'       => self::$subscriber_id,
+        );
+        $request = new WP_REST_Request( 'POST', '/wp/v2/comments' );
+        $request->add_header( 'content-type', 'application/json' );
+        $request->set_body( wp_json_encode( $params ) );
+
+        $response = $this->server->dispatch( $request );
         $this->assertErrorResponse( 'rest_cannot_read_post', $response, 403 );
     }