Changeset 39487

Timestamp:

12/04/2016 07:29:18 PM (10 years ago)

Author:

jnylen0

Message:

REST API: Treat any falsy value as false in 'rest_allow_anonymous_comments'.

Extend the check in 'rest_allow_anonymous_comments' to accept any falsy value
(previously this was an explicit check for false).

One possible failure case is that a plugin developer forgets to include a
return value for some code path in their callback for this filter, leading to a
value of null which is currently treated like true.

Props joehoyle, jnylen0.

Fixes #39010.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-comments-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -393 +393 @@
                          */
                         $allow_anonymous = apply_filters( 'rest_allow_anonymous_comments', false, $request );
-                        if ( false === $allow_anonymous ) {
+                        if ( ! $allow_anonymous ) {
                                 return new WP_Error( 'rest_comment_login_required', __( 'Sorry, you must be logged in to comment.' ), array( 'status' => 401 ) );
                         }

trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -1748 +1748 @@
                 $response = $this->server->dispatch( $request );
                 $this->assertEquals( 400, $response->get_status() );
+        }
+
+        public function anonymous_comments_callback_null() {
+                // I'm a plugin developer who forgot to include a return value for some
+                // code path in my 'rest_allow_anonymous_comments' filter.
+        }
+
+        public function test_allow_anonymous_comments_null() {
+                add_filter( 'rest_allow_anonymous_comments', array( $this, 'anonymous_comments_callback_null' ), 10, 2 );
+
+                $params = array(
+                        'post'         => self::$post_id,
+                        'author_name'  => 'Comic Book Guy',
+                        'author_email' => 'cbg@androidsdungeon.com',
+                        'author_url'   => 'http://androidsdungeon.com',
+                        'content'      => 'Worst Comment Ever!',
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/comments' );
+                $request->add_header( 'content-type', 'application/json' );
+                $request->set_body( wp_json_encode( $params ) );
+
+                $response = $this->server->dispatch( $request );
+
+                remove_filter( 'rest_allow_anonymous_comments', array( $this, 'anonymous_comments_callback_null' ), 10, 2 );
+
+                $this->assertErrorResponse( 'rest_comment_login_required', $response, 401 );
         }