Changeset 46433

Timestamp:

10/08/2019 04:00:25 AM (7 years ago)

Author:

kadamwhite

Message:

REST API: Ensure users with "moderate_comments" capability may edit comments.

Props meloniq.
Fixes #47024.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-comments-controller.php (modified) (5 diffs)
• tests/qunit/fixtures/wp-api-generated.js (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -1673 +1673 @@
                 }
 
-                if ( ! current_user_can( 'moderate_comments' ) ) {
-                        return false;
+                if ( current_user_can( 'moderate_comments' ) ) {
+                        return true;
                 }
 

trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -14 +14 @@
         protected static $admin_id;
         protected static $editor_id;
+        protected static $moderator_id;
         protected static $subscriber_id;
         protected static $author_id;
@@ -28 +29 @@
 
         public static function wpSetUpBeforeClass( $factory ) {
+                add_role(
+                        'comment_moderator',
+                        'Comment Moderator',
+                        array(
+                                'read'              => true,
+                                'moderate_comments' => true,
+                        )
+                );
+
                 self::$superadmin_id = $factory->user->create(
                         array(
@@ -42 +52 @@
                         array(
                                 'role' => 'editor',
+                        )
+                );
+                self::$moderator_id  = $factory->user->create(
+                        array(
+                                'role' => 'comment_moderator',
                         )
                 );
@@ -99 +114 @@
 
         public static function wpTearDownAfterClass() {
+                remove_role( 'comment_moderator' );
+
                 self::delete_user( self::$superadmin_id );
                 self::delete_user( self::$admin_id );
                 self::delete_user( self::$editor_id );
+                self::delete_user( self::$moderator_id );
                 self::delete_user( self::$subscriber_id );
                 self::delete_user( self::$author_id );
@@ -2481 +2499 @@
         }
 
+        /**
+         * @ticket 47024
+         */
+        public function test_update_comment_when_can_moderate_comments() {
+                wp_set_current_user( self::$moderator_id );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/comments/%d', self::$approved_id ) );
+                $params  = array(
+                        'content' => 'Updated comment.',
+                        'date'    => '2019-10-07T23:14:25',
+                );
+                $request->add_header( 'content-type', 'application/json' );
+                $request->set_body( wp_json_encode( $params ) );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $comment = $response->get_data();
+                $updated = get_comment( self::$approved_id );
+
+                $this->assertEquals( $params['content'], $updated->comment_content );
+                $this->assertEquals( self::$post_id, $comment['post'] );
+                $this->assertEquals( '2019-10-07T23:14:25', $comment['date'] );
+        }
+
         public function test_update_comment_private_post_invalid_permission() {
                 $private_comment_id = $this->factory->comment->create(

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -2305 +2305 @@
             ]
         },
-        "/wp/v2/media/(?P<id>[\\d+])/post-process": {
+        "/wp/v2/media/(?P<id>[\\d]+)/post-process": {
             "namespace": "wp/v2",
             "methods": [