WordPress.org

Make WordPress Core


Ignore:
Timestamp:
08/15/2019 10:00:49 PM (2 months ago)
Author:
kadamwhite
Message:

REST API: Prevent deletion of post revisions.

Allowing the client to delete revisions breaks the "audit trail" functionality. This is not allowed in WordPress and shouldn't be allowed through the API.
While not recommended, a plugin may opt-in to the previous behavior by setting a custom 'delete_post' capability for the revisions post type.

Props dlh, danielbachhuber, TimothyBlynJacobs, azaozz, kadamwhite.
Fixes #43709.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php

    r45811 r45812  
    350350        }
    351351
     352        $parent_post_type = get_post_type_object( $parent->post_type );
     353        if ( ! current_user_can( $parent_post_type->cap->delete_post, $parent->ID ) ) {
     354            return new WP_Error( 'rest_cannot_delete', __( 'Sorry, you are not allowed to delete revisions of this post.' ), array( 'status' => rest_authorization_required_code() ) );
     355        }
     356
    352357        $revision = $this->get_revision( $request['id'] );
    353358        if ( is_wp_error( $revision ) ) {
     
    384389
    385390        $post_type = get_post_type_object( 'revision' );
    386         return current_user_can( $post_type->cap->delete_post, $revision->ID );
     391
     392        if ( ! current_user_can( $post_type->cap->delete_post, $revision->ID ) ) {
     393            return new WP_Error( 'rest_cannot_delete', __( 'Sorry, you are not allowed to delete this revision.' ), array( 'status' => rest_authorization_required_code() ) );
     394        }
     395
     396        return true;
    387397    }
    388398
Note: See TracChangeset for help on using the changeset viewer.