Changeset 39295 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

Timestamp:

11/18/2016 07:06:26 PM (8 years ago)

Author:

joehoyle

Message:

REST API: Check read permissions on posts when viewing comments.

With a few tests for getting / creating comments to reflect core behaviour.

Props timmyc.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -1455 +1455 @@
     protected function check_read_post_permission( $post ) {
         $posts_controller = new WP_REST_Posts_Controller( $post->post_type );
+        $post_type = get_post_type_object( $post->post_type );
+
+        if ( post_password_required( $post ) ) {
+            return current_user_can( $post_type->cap->edit_post, $post->ID );
+        }
 
         return $posts_controller->check_read_permission( $post );