Changeset 46433

Timestamp:

10/08/2019 04:00:25 AM (5 years ago)

Author:

kadamwhite

Message:

REST API: Ensure users with "moderate_comments" capability may edit comments.

Props meloniq.
Fixes #47024.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-comments-controller.php (modified) (5 diffs)
• tests/qunit/fixtures/wp-api-generated.js (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -1673 +1673 @@
         }
 
-        if ( ! current_user_can( 'moderate_comments' ) ) {
-            return false;
+        if ( current_user_can( 'moderate_comments' ) ) {
+            return true;
         }
 

trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -14 +14 @@
     protected static $admin_id;
     protected static $editor_id;
+    protected static $moderator_id;
     protected static $subscriber_id;
     protected static $author_id;
@@ -28 +29 @@
 
     public static function wpSetUpBeforeClass( $factory ) {
+        add_role(
+            'comment_moderator',
+            'Comment Moderator',
+            array(
+                'read'              => true,
+                'moderate_comments' => true,
+            )
+        );
+
         self::$superadmin_id = $factory->user->create(
             array(
@@ -42 +52 @@
             array(
                 'role' => 'editor',
+            )
+        );
+        self::$moderator_id  = $factory->user->create(
+            array(
+                'role' => 'comment_moderator',
             )
         );
@@ -99 +114 @@
 
     public static function wpTearDownAfterClass() {
+        remove_role( 'comment_moderator' );
+
         self::delete_user( self::$superadmin_id );
         self::delete_user( self::$admin_id );
         self::delete_user( self::$editor_id );
+        self::delete_user( self::$moderator_id );
         self::delete_user( self::$subscriber_id );
         self::delete_user( self::$author_id );
@@ -2481 +2499 @@
     }
 
+    /**
+     * @ticket 47024
+     */
+    public function test_update_comment_when_can_moderate_comments() {
+        wp_set_current_user( self::$moderator_id );
+
+        $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/comments/%d', self::$approved_id ) );
+        $params  = array(
+            'content' => 'Updated comment.',
+            'date'    => '2019-10-07T23:14:25',
+        );
+        $request->add_header( 'content-type', 'application/json' );
+        $request->set_body( wp_json_encode( $params ) );
+
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertEquals( 200, $response->get_status() );
+
+        $comment = $response->get_data();
+        $updated = get_comment( self::$approved_id );
+
+        $this->assertEquals( $params['content'], $updated->comment_content );
+        $this->assertEquals( self::$post_id, $comment['post'] );
+        $this->assertEquals( '2019-10-07T23:14:25', $comment['date'] );
+    }
+
     public function test_update_comment_private_post_invalid_permission() {
         $private_comment_id = $this->factory->comment->create(

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -2305 +2305 @@
             ]
         },
-        "/wp/v2/media/(?P<id>[\\d+])/post-process": {
+        "/wp/v2/media/(?P<id>[\\d]+)/post-process": {
             "namespace": "wp/v2",
             "methods": [