Changeset 43682

Timestamp:

10/08/2018 10:44:05 PM (6 years ago)

Author:

danielbachhuber

Message:

REST API: Declare unfiltered_html capability in links.

Because user capabilities can be modified at runtime, the REST API needs to expose them in some evaluated but declarative manner for clients to interpret. JSON Hyper Schema targetSchema provides an appropriate paradigm for doing so.

Props timothyblynjacobs.
Fixes #45014.

Location:

branches/5.0

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/rest-posts-controller.php (modified) (1 diff)

branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -1769 +1769 @@
         if ( 'attachment' !== $this->post_type && current_user_can( $post_type->cap->publish_posts ) ) {
             $rels[] = 'https://api.w.org/action-publish';
+        }
+
+        if ( current_user_can( 'unfiltered_html' ) ) {
+            $rels[] = 'https://api.w.org/action-unfiltered-html';
         }
 
@@ -2180 +2184 @@
         }
 
+        $links[] = array(
+            'rel'          => 'https://api.w.org/action-unfiltered-html',
+            'title'        => __( 'The current user can post unfiltered HTML markup and JavaScript.' ),
+            'href'         => $href,
+            'targetSchema' => array(
+                'type'        => 'object',
+                'properties'  => array(
+                    'content' => array(
+                        'raw' => array(
+                            'type' => 'string',
+                        ),
+                    ),
+                ),
+            ),
+        );
+
         if ( 'post' === $this->post_type ) {
             $links[] = array(

branches/5.0/tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -3591 +3591 @@
     }
 
+    public function test_assign_unfiltered_html_action_superadmin() {
+        $post_id = self::factory()->post->create();
+        wp_set_current_user( self::$superadmin_id );
+        $request = new WP_REST_Request( 'GET', '/wp/v2/posts/' . $post_id );
+        $request->set_param( 'context', 'edit' );
+        $response = rest_do_request( $request );
+        $links    = $response->get_links();
+        $this->assertArrayHasKey( 'https://api.w.org/action-unfiltered-html', $links );
+    }
+
+    public function test_assign_unfiltered_html_action_editor() {
+        $post_id = self::factory()->post->create();
+        wp_set_current_user( self::$editor_id );
+        $request = new WP_REST_Request( 'GET', '/wp/v2/posts/' . $post_id );
+        $request->set_param( 'context', 'edit' );
+        $response = rest_do_request( $request );
+        $links    = $response->get_links();
+        // Editors can only unfiltered html on single site.
+        if ( is_multisite() ) {
+            $this->assertArrayNotHasKey( 'https://api.w.org/action-unfiltered-html', $links );
+        } else {
+            $this->assertArrayHasKey( 'https://api.w.org/action-unfiltered-html', $links );
+        }
+    }
+
+    public function test_assign_unfiltered_html_action_author() {
+        $post_id = self::factory()->post->create();
+        wp_set_current_user( self::$author_id );
+        $request = new WP_REST_Request( 'GET', '/wp/v2/posts/' . $post_id );
+        $request->set_param( 'context', 'edit' );
+        $response = rest_do_request( $request );
+        $links    = $response->get_links();
+        // Authors can't ever unfiltered html
+        $this->assertArrayNotHasKey( 'https://api.w.org/action-unfiltered-html', $links );
+    }
+
     public function tearDown() {
         _unregister_post_type( 'youseeeme' );