Changeset 43443

Timestamp:

07/13/2018 06:28:29 AM (6 years ago)

Author:

pento

Message:

REST API: Tweak permission checks for taxonomy and term endpoints

To match behaviour in the Classic Editor, we need to slightly loosen permissions on taxonomy and term endpoints. This allows users to create terms to assign to a post that they're editing.

Merges [43440] to the 4.9 branch.

Props danielbachhuber.
Fixes #44096.

Location:

branches/4.9

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-taxonomies-controller.php (modified) (3 diffs)
• src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-categories-controller.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/rest-tags-controller.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/rest-taxonomies-controller.php (modified) (1 diff)

branches/4.9/src/wp-includes/rest-api/endpoints/class-wp-rest-taxonomies-controller.php

@@ -81 +81 @@
             }
             foreach ( $taxonomies as $taxonomy ) {
-                if ( ! empty( $taxonomy->show_in_rest ) && current_user_can( $taxonomy->cap->manage_terms ) ) {
+                if ( ! empty( $taxonomy->show_in_rest ) && current_user_can( $taxonomy->cap->assign_terms ) ) {
                     return true;
                 }
@@ -110 +110 @@
         $data = array();
         foreach ( $taxonomies as $tax_type => $value ) {
-            if ( empty( $value->show_in_rest ) || ( 'edit' === $request['context'] && ! current_user_can( $value->cap->manage_terms ) ) ) {
+            if ( empty( $value->show_in_rest ) || ( 'edit' === $request['context'] && ! current_user_can( $value->cap->assign_terms ) ) ) {
                 continue;
             }
@@ -142 +142 @@
                 return false;
             }
-            if ( 'edit' === $request['context'] && ! current_user_can( $tax_obj->cap->manage_terms ) ) {
+            if ( 'edit' === $request['context'] && ! current_user_can( $tax_obj->cap->assign_terms ) ) {
                 return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to manage terms in this taxonomy.' ), array( 'status' => rest_authorization_required_code() ) );
             }

branches/4.9/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php

@@ -377 +377 @@
 
         $taxonomy_obj = get_taxonomy( $this->taxonomy );
-        if ( ! current_user_can( $taxonomy_obj->cap->edit_terms ) ) {
+        if ( ( is_taxonomy_hierarchical( $this->taxonomy )
+                && ! current_user_can( $taxonomy_obj->cap->edit_terms ) )
+            || ( ! is_taxonomy_hierarchical( $this->taxonomy )
+                && ! current_user_can( $taxonomy_obj->cap->assign_terms ) ) ) {
             return new WP_Error( 'rest_cannot_create', __( 'Sorry, you are not allowed to create new terms.' ), array( 'status' => rest_authorization_required_code() ) );
         }

branches/4.9/tests/phpunit/tests/rest-api/rest-categories-controller.php

@@ -13 +13 @@
 class WP_Test_REST_Categories_Controller extends WP_Test_REST_Controller_Testcase {
     protected static $administrator;
+    protected static $contributor;
     protected static $subscriber;
 
     public static function wpSetUpBeforeClass( $factory ) {
-        self::$administrator = $factory->user->create( array(
-            'role' => 'administrator',
-        ) );
-        self::$subscriber = $factory->user->create( array(
-            'role' => 'subscriber',
-        ) );
+        self::$administrator = $factory->user->create(
+            array(
+                'role' => 'administrator',
+            )
+        );
+        self::$contributor   = $factory->user->create(
+            array(
+                'role' => 'subscriber',
+            )
+        );
+        self::$subscriber    = $factory->user->create(
+            array(
+                'role' => 'subscriber',
+            )
+        );
     }
 
@@ -654 +664 @@
     }
 
+    public function test_create_item_incorrect_permissions_contributor() {
+        wp_set_current_user( self::$contributor );
+        $request = new WP_REST_Request( 'POST', '/wp/v2/categories' );
+        $request->set_param( 'name', 'Incorrect permissions' );
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertErrorResponse( 'rest_cannot_create', $response, 403 );
+    }
+
     public function test_create_item_missing_arguments() {
         wp_set_current_user( self::$administrator );

branches/4.9/tests/phpunit/tests/rest-api/rest-tags-controller.php

@@ -14 +14 @@
     protected static $administrator;
     protected static $editor;
+    protected static $contributor;
     protected static $subscriber;
 
     public static function wpSetUpBeforeClass( $factory ) {
-        self::$superadmin = $factory->user->create( array(
-            'role'       => 'administrator',
-            'user_login' => 'superadmin',
-        ) );
-        self::$administrator = $factory->user->create( array(
-            'role' => 'administrator',
-        ) );
-        self::$editor = $factory->user->create( array(
-            'role' => 'editor',
-        ) );
-        self::$subscriber = $factory->user->create( array(
-            'role' => 'subscriber',
-        ) );
+        self::$superadmin    = $factory->user->create(
+            array(
+                'role'       => 'administrator',
+                'user_login' => 'superadmin',
+            )
+        );
+        self::$administrator = $factory->user->create(
+            array(
+                'role' => 'administrator',
+            )
+        );
+        self::$editor        = $factory->user->create(
+            array(
+                'role' => 'editor',
+            )
+        );
+        self::$contributor   = $factory->user->create(
+            array(
+                'role' => 'contributor',
+            )
+        );
+        self::$subscriber    = $factory->user->create(
+            array(
+                'role' => 'subscriber',
+            )
+        );
         if ( is_multisite() ) {
             update_site_option( 'site_admins', array( 'superadmin' ) );
@@ -556 +570 @@
         $headers = $response->get_headers();
         $data = $response->get_data();
+        $this->assertContains( '/wp/v2/tags/' . $data['id'], $headers['Location'] );
+        $this->assertEquals( 'My Awesome Term', $data['name'] );
+        $this->assertEquals( 'This term is so awesome.', $data['description'] );
+        $this->assertEquals( 'so-awesome', $data['slug'] );
+    }
+
+    public function test_create_item_contributor() {
+        wp_set_current_user( self::$contributor );
+        $request = new WP_REST_Request( 'POST', '/wp/v2/tags' );
+        $request->set_param( 'name', 'My Awesome Term' );
+        $request->set_param( 'description', 'This term is so awesome.' );
+        $request->set_param( 'slug', 'so-awesome' );
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertEquals( 201, $response->get_status() );
+        $headers = $response->get_headers();
+        $data    = $response->get_data();
         $this->assertContains( '/wp/v2/tags/' . $data['id'], $headers['Location'] );
         $this->assertEquals( 'My Awesome Term', $data['name'] );

branches/4.9/tests/phpunit/tests/rest-api/rest-taxonomies-controller.php

@@ -52 +52 @@
         $response = $this->server->dispatch( $request );
         $data = $response->get_data();
+        $taxonomies = $this->get_public_taxonomies( get_taxonomies( '', 'objects' ) );
+        $this->assertEquals( count( $taxonomies ), count( $data ) );
+        $this->assertEquals( 'Categories', $data['category']['name'] );
+        $this->assertEquals( 'category', $data['category']['slug'] );
+        $this->assertEquals( true, $data['category']['hierarchical'] );
+        $this->assertEquals( 'Tags', $data['post_tag']['name'] );
+        $this->assertEquals( 'post_tag', $data['post_tag']['slug'] );
+        $this->assertEquals( false, $data['post_tag']['hierarchical'] );
+        $this->assertEquals( 'tags', $data['post_tag']['rest_base'] );
+    }
+
+    public function test_get_items_context_edit() {
+        wp_set_current_user( self::$contributor_id );
+        $request    = new WP_REST_Request( 'GET', '/wp/v2/taxonomies' );
+        $request->set_param( 'context', 'edit' );
+        $response   = rest_get_server()->dispatch( $request );
+        $data       = $response->get_data();
         $taxonomies = $this->get_public_taxonomies( get_taxonomies( '', 'objects' ) );
         $this->assertEquals( count( $taxonomies ), count( $data ) );