Changeset 43694

Timestamp:

10/10/2018 08:48:21 PM (6 years ago)

Author:

danielbachhuber

Message:

REST API: Enable users with read_private_posts to query for them.

An authorized request with the read_private_posts capability for a post type should be able to GET /wp/v2/posts for posts of status=private. This query is further sanity-checked by WP_REST_Posts_Controller->check_read_permission(), which is unchanged.

Props rachelbaker, soulseekah, twoelevenjay.
Fixes #43701.

Location:

branches/5.0

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-posts-controller.php (modified) (6 diffs)

branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -2499 +2499 @@
             $post_type_obj = get_post_type_object( $this->post_type );
 
-            if ( current_user_can( $post_type_obj->cap->edit_posts ) ) {
+            if ( current_user_can( $post_type_obj->cap->edit_posts ) || 'private' === $status && current_user_can( $post_type_obj->cap->read_private_posts ) ) {
                 $result = rest_validate_request_arg( $status, $request, $parameter );
                 if ( is_wp_error( $result ) ) {

branches/5.0/tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -17 +17 @@
     protected static $author_id;
     protected static $contributor_id;
+    protected static $private_reader_id;
 
     protected static $supported_formats;
@@ -39 +40 @@
             'role' => 'contributor',
         ) );
+
+        self::$private_reader_id = $factory->user->create(
+            array(
+                'role' => 'private_reader',
+            )
+        );
 
         if ( is_multisite() ) {
@@ -63 +70 @@
         self::delete_user( self::$author_id );
         self::delete_user( self::$contributor_id );
+        self::delete_user( self::$private_reader_id );
     }
 
@@ -68 +76 @@
         parent::setUp();
         register_post_type( 'youseeme', array( 'supports' => array(), 'show_in_rest' => true ) );
+
+        add_role( 'private_reader', 'Private Reader' );
+        $role = get_role( 'private_reader' );
+        $role->add_cap( 'read_private_posts' );
+
         add_filter( 'rest_pre_dispatch', array( $this, 'wpSetUpBeforeRequest' ), 10, 3 );
         add_filter( 'posts_clauses', array( $this, 'save_posts_clauses' ), 10, 2 );
@@ -498 +511 @@
     }
 
+    /**
+     * @ticket 43701
+     */
+    public function test_get_items_multiple_statuses_custom_role_one_invalid_query() {
+        $private_post_id = $this->factory->post->create( array( 'post_status' => 'private' ) );
+
+        wp_set_current_user( self::$private_reader_id );
+        $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+        $request->set_param( 'status', array( 'private', 'future' ) );
+
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+    }
+
     public function test_get_items_invalid_status_query() {
         wp_set_current_user( 0 );
@@ -994 +1021 @@
     }
 
-    public function test_get_items_private_status_query_var() {
-        // Private query vars inaccessible to unauthorized users
+    public function test_get_items_status_draft_permissions() {
+        $draft_id = $this->factory->post->create( array( 'post_status' => 'draft' ) );
+
+        // Drafts status query var inaccessible to unauthorized users.
         wp_set_current_user( 0 );
-        $draft_id = $this->factory->post->create( array( 'post_status' => 'draft' ) );
-        $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+        $request  = new WP_REST_Request( 'GET', '/wp/v2/posts' );
         $request->set_param( 'status', 'draft' );
-        $response = $this->server->dispatch( $request );
+        $response = rest_get_server()->dispatch( $request );
         $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
 
-        // But they are accessible to authorized users
-        wp_set_current_user( self::$editor_id );
-        $response = $this->server->dispatch( $request );
-        $data = $response->get_data();
+        // Users with 'read_private_posts' cap shouldn't also be able to view drafts.
+        wp_set_current_user( self::$private_reader_id );
+        $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+        $request->set_param( 'status', 'draft' );
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+
+        // But drafts are accessible to authorized users.
+        wp_set_current_user( self::$editor_id );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+
+        $this->assertEquals( $draft_id, $data[0]['id'] );
+    }
+
+    /**
+     * @ticket 43701
+     */
+    public function test_get_items_status_private_permissions() {
+        $private_post_id = $this->factory->post->create( array( 'post_status' => 'private' ) );
+
+        wp_set_current_user( 0 );
+        $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+        $request->set_param( 'status', 'private' );
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+
+        wp_set_current_user( self::$private_reader_id );
+        $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+        $request->set_param( 'status', 'private' );
+
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+        $this->assertEquals( 200, $response->get_status() );
         $this->assertCount( 1, $data );
-        $this->assertEquals( $draft_id, $data[0]['id'] );
+        $this->assertEquals( $private_post_id, $data[0]['id'] );
     }