Changeset 39349 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

Timestamp:

11/23/2016 04:14:08 PM (7 years ago)

Author:

joehoyle

Message:

REST API: Add support for comments of password-protected posts.

Core requires the post password to view and create comments on password protected posts, so we must support a “password” param on the comments endpoint when fetch comments for a specific post and creating a comment on a password protected post.

Props flixos90, jnylen0.
Fixes #38692.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (9 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -70 +70 @@
                 'args'     => array(
                     'context'          => $this->get_context_param( array( 'default' => 'view' ) ),
+                    'password' => array(
+                        'description' => __( 'The password for the post if it is password protected.' ),
+                        'type'        => 'string',
+                    ),
                 ),
             ),
@@ -88 +92 @@
                         'description' => __( 'Whether to bypass trash and force deletion.' ),
                     ),
+                    'password' => array(
+                        'description' => __( 'The password for the post if it is password protected.' ),
+                        'type'        => 'string',
+                    ),
                 ),
             ),
@@ -109 +117 @@
                 $post = get_post( $post_id );
 
-                if ( ! empty( $post_id ) && $post && ! $this->check_read_post_permission( $post ) ) {
+                if ( ! empty( $post_id ) && $post && ! $this->check_read_post_permission( $post, $request ) ) {
                     return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
                 } elseif ( 0 === $post_id && ! current_user_can( 'moderate_comments' ) ) {
@@ -243 +251 @@
 
         foreach ( $query_result as $comment ) {
-            if ( ! $this->check_read_permission( $comment ) ) {
+            if ( ! $this->check_read_permission( $comment, $request ) ) {
                 continue;
             }
@@ -310 +318 @@
         }
 
-        if ( ! $this->check_read_permission( $comment ) ) {
-            return new WP_Error( 'rest_cannot_read', __( 'Sorry, you are not allowed to read this comment.' ), array( 'status' => rest_authorization_required_code() ) );
-        }
-
-        $post = get_post( $comment->comment_post_ID );
-
-        if ( $post && ! $this->check_read_post_permission( $post ) ) {
-            return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
-        }
-
         if ( ! empty( $request['context'] ) && 'edit' === $request['context'] && ! current_user_can( 'moderate_comments' ) ) {
             return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit comments.' ), array( 'status' => rest_authorization_required_code() ) );
+        }
+
+        $post = get_post( $comment->comment_post_ID );
+
+        if ( ! $this->check_read_permission( $comment, $request ) ) {
+            return new WP_Error( 'rest_cannot_read', __( 'Sorry, you are not allowed to read this comment.' ), array( 'status' => rest_authorization_required_code() ) );
+        }
+
+        if ( $post && ! $this->check_read_post_permission( $post, $request ) ) {
+            return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
         }
 
@@ -434 +442 @@
         }
 
-        if ( ! $this->check_read_post_permission( $post ) ) {
+        if ( ! $this->check_read_post_permission( $post, $request ) ) {
             return new WP_Error( 'rest_cannot_read_post', __( 'Sorry, you are not allowed to read the post for this comment.' ), array( 'status' => rest_authorization_required_code() ) );
         }
@@ -1411 +1419 @@
             'type'              => 'string',
             'validate_callback' => 'rest_validate_request_arg',
+        );
+
+        $query_params['password'] = array(
+            'description' => __( 'The password for the post if it is password protected.' ),
+            'type'        => 'string',
         );
 
@@ -1482 +1495 @@
      * @access protected
      *
-     * @param WP_Post $post Post Object.
+     * @param WP_Post         $post    Post object.
+     * @param WP_REST_Request $request Request data to check.
      * @return bool Whether post can be read.
      */
-    protected function check_read_post_permission( $post ) {
+    protected function check_read_post_permission( $post, $request ) {
         $posts_controller = new WP_REST_Posts_Controller( $post->post_type );
         $post_type = get_post_type_object( $post->post_type );
 
+        $has_password_filter = false;
+
+        // Only check password if a specific post was queried for or a single comment
+        $requested_post = ! empty( $request['post'] ) && 1 === count( $request['post'] );
+        $requested_comment = ! empty( $request['id'] );
+        if ( ( $requested_post || $requested_comment ) && $posts_controller->can_access_password_content( $post, $request ) ) {
+            add_filter( 'post_password_required', '__return_false' );
+
+            $has_password_filter = true;
+        }
+
         if ( post_password_required( $post ) ) {
-            return current_user_can( $post_type->cap->edit_post, $post->ID );
-        }
-
-        return $posts_controller->check_read_permission( $post );
+            $result = current_user_can( $post_type->cap->edit_post, $post->ID );
+        } else {
+            $result = $posts_controller->check_read_permission( $post );
+        }
+
+        if ( $has_password_filter ) {
+            remove_filter( 'post_password_required', '__return_false' );
+        }
+
+        return $result;
     }
 
@@ -1502 +1533 @@
      * @access protected
      *
-     * @param WP_Comment $comment Comment object.
+     * @param WP_Comment      $comment Comment object.
+     * @param WP_REST_Request $request Request data to check.
      * @return bool Whether the comment can be read.
      */
-    protected function check_read_permission( $comment ) {
+    protected function check_read_permission( $comment, $request ) {
         if ( ! empty( $comment->comment_post_ID ) ) {
             $post = get_post( $comment->comment_post_ID );
             if ( $post ) {
-                if ( $this->check_read_post_permission( $post ) && 1 === (int) $comment->comment_approved ) {
+                if ( $this->check_read_post_permission( $post, $request ) && 1 === (int) $comment->comment_approved ) {
                     return true;
                 }