Changeset 47562

Timestamp:

04/09/2020 10:50:26 PM (5 years ago)

Author:

whyisjake

Message:

REST API: Fix revisions controller get_item permission check.
r45812 incorrectly introduced a delete_post permissions check into the get_item method, breaking some plugins which requested revisions when generating previews.

Bring this commit back to the 5.4 branch.

Props sorenbronsted, yohannp, TimothyBlynJacobs.

Fixes #49645.

Location:

branches/5.4

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-revisions-controller.php (modified) (2 diffs)

branches/5.4/src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php

@@ -385 +385 @@
         }
 
+        $revision = $this->get_revision( $request['id'] );
+        if ( is_wp_error( $revision ) ) {
+            return $revision;
+        }
+
+        $response = $this->prepare_item_for_response( $revision, $request );
+        return rest_ensure_response( $response );
+    }
+
+    /**
+     * Checks if a given request has access to delete a revision.
+     *
+     * @since 4.7.0
+     *
+     * @param WP_REST_Request $request Full details about the request.
+     * @return bool|WP_Error True if the request has access to delete the item, WP_Error object otherwise.
+     */
+    public function delete_item_permissions_check( $request ) {
+        $parent = $this->get_parent( $request['parent'] );
+        if ( is_wp_error( $parent ) ) {
+            return $parent;
+        }
+
         $parent_post_type = get_post_type_object( $parent->post_type );
 
@@ -400 +423 @@
         }
 
-        $response = $this->prepare_item_for_response( $revision, $request );
-        return rest_ensure_response( $response );
-    }
-
-    /**
-     * Checks if a given request has access to delete a revision.
-     *
-     * @since 4.7.0
-     *
-     * @param WP_REST_Request $request Full details about the request.
-     * @return bool|WP_Error True if the request has access to delete the item, WP_Error object otherwise.
-     */
-    public function delete_item_permissions_check( $request ) {
-        $parent = $this->get_parent( $request['parent'] );
-        if ( is_wp_error( $parent ) ) {
-            return $parent;
-        }
-
-        $revision = $this->get_revision( $request['id'] );
-        if ( is_wp_error( $revision ) ) {
-            return $revision;
-        }
-
         $response = $this->get_items_permissions_check( $request );
         if ( ! $response || is_wp_error( $response ) ) {
@@ -447 +447 @@
      *
      * @param WP_REST_Request $request Full details about the request.
-     * @return true|WP_Error True on success, or WP_Error object on failure.
+     * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
      */
     public function delete_item( $request ) {

branches/5.4/tests/phpunit/tests/rest-api/rest-revisions-controller.php

@@ -243 +243 @@
 
     /**
+     * @ticket 49645
+     */
+    public function test_delete_item_parent_check() {
+        wp_set_current_user( self::$contributor_id );
+        $request = new WP_REST_Request( 'DELETE', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_id1 );
+        $request->set_param( 'force', true );
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
+        $this->assertNotNull( get_post( $this->revision_id1 ) );
+    }
+
+    /**
      * @ticket 43709
      */
@@ -290 +302 @@
         $request  = new WP_REST_Request( 'DELETE', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_id1 );
         $response = rest_get_server()->dispatch( $request );
-        $this->assertErrorResponse( 'rest_cannot_read', $response, 403 );
+        $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
     }