Changeset 47547 for trunk

Timestamp:

04/03/2020 07:38:15 PM (6 years ago)

Author:

kadamwhite

Message:

REST API: Fix revisions controller get_item permission check.

r45812 incorrectly introduced a delete_post permissions check into the get_item method, breaking some plugins which requested revisions when generating previews.

Props sorenbronsted, yohannp, TimothyBlynJacobs.
Fixes #49645.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-revisions-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php

@@ -385 +385 @@
                 }
 
+                $revision = $this->get_revision( $request['id'] );
+                if ( is_wp_error( $revision ) ) {
+                        return $revision;
+                }
+
+                $response = $this->prepare_item_for_response( $revision, $request );
+                return rest_ensure_response( $response );
+        }
+
+        /**
+         * Checks if a given request has access to delete a revision.
+         *
+         * @since 4.7.0
+         *
+         * @param WP_REST_Request $request Full details about the request.
+         * @return bool|WP_Error True if the request has access to delete the item, WP_Error object otherwise.
+         */
+        public function delete_item_permissions_check( $request ) {
+                $parent = $this->get_parent( $request['parent'] );
+                if ( is_wp_error( $parent ) ) {
+                        return $parent;
+                }
+
                 $parent_post_type = get_post_type_object( $parent->post_type );
 
@@ -400 +423 @@
                 }
 
-                $response = $this->prepare_item_for_response( $revision, $request );
-                return rest_ensure_response( $response );
-        }
-
-        /**
-         * Checks if a given request has access to delete a revision.
-         *
-         * @since 4.7.0
-         *
-         * @param WP_REST_Request $request Full details about the request.
-         * @return bool|WP_Error True if the request has access to delete the item, WP_Error object otherwise.
-         */
-        public function delete_item_permissions_check( $request ) {
-                $parent = $this->get_parent( $request['parent'] );
-                if ( is_wp_error( $parent ) ) {
-                        return $parent;
-                }
-
-                $revision = $this->get_revision( $request['id'] );
-                if ( is_wp_error( $revision ) ) {
-                        return $revision;
-                }
-
                 $response = $this->get_items_permissions_check( $request );
                 if ( ! $response || is_wp_error( $response ) ) {
@@ -447 +447 @@
          *
          * @param WP_REST_Request $request Full details about the request.
-         * @return true|WP_Error True on success, or WP_Error object on failure.
+         * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
          */
         public function delete_item( $request ) {

trunk/tests/phpunit/tests/rest-api/rest-revisions-controller.php

@@ -243 +243 @@
 
         /**
+         * @ticket 49645
+         */
+        public function test_delete_item_parent_check() {
+                wp_set_current_user( self::$contributor_id );
+                $request = new WP_REST_Request( 'DELETE', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_id1 );
+                $request->set_param( 'force', true );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
+                $this->assertNotNull( get_post( $this->revision_id1 ) );
+        }
+
+        /**
          * @ticket 43709
          */
@@ -290 +302 @@
                 $request  = new WP_REST_Request( 'DELETE', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_id1 );
                 $response = rest_get_server()->dispatch( $request );
-                $this->assertErrorResponse( 'rest_cannot_read', $response, 403 );
+                $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
         }