Changeset 49302

Timestamp:

10/24/2020 04:02:34 PM (6 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Don't validate status if it hasn't changed.

In particular, this allows for sending status=inherit to an attachment if it's current status is inherit. This status would be rejected because it is an "internal" post status which isn't exposed.

As a general rule, a developer should always be able to PUT back a GET response without error.

Props dfenton, pputzer, TimothyBlynJacobs.
Fixes #40399.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (5 diffs)
• tests/phpunit/tests/rest-api/rest-attachments-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -1053 +1053 @@
          */
         protected function prepare_item_for_database( $request ) {
-                $prepared_post = new stdClass();
+                $prepared_post  = new stdClass();
+                $current_status = '';
 
                 // Post ID.
@@ -1063 +1064 @@
 
                         $prepared_post->ID = $existing_post->ID;
+                        $current_status    = $existing_post->post_status;
                 }
 
@@ -1106 +1108 @@
 
                 // Post status.
-                if ( ! empty( $schema['properties']['status'] ) && isset( $request['status'] ) ) {
+                if (
+                        ! empty( $schema['properties']['status'] ) &&
+                        isset( $request['status'] ) &&
+                        ( ! $current_status || $current_status !== $request['status'] )
+                ) {
                         $status = $this->handle_status_param( $request['status'], $post_type );
 
@@ -1254 +1260 @@
                 return apply_filters( "rest_pre_insert_{$this->post_type}", $prepared_post, $request );
 
+        }
+
+        /**
+         * Checks whether the status is valid for the given post.
+         *
+         * Allows for sending an update request with the current status, even if that status would not be acceptable.
+         *
+         * @since 5.6.0
+         *
+         * @param string          $status  The provided status.
+         * @param WP_REST_Request $request The request object.
+         * @param string          $param   The parameter name.
+         * @return true|WP_Error True if the status is valid, or WP_Error if not.
+         */
+        public function check_status( $status, $request, $param ) {
+                if ( $request['id'] ) {
+                        $post = $this->get_post( $request['id'] );
+
+                        if ( ! is_wp_error( $post ) && $post->post_status === $status ) {
+                                return true;
+                        }
+                }
+
+                $args = $request->get_attributes()['args'][ $param ];
+
+                return rest_validate_value_from_schema( $status, $args, $param );
         }
 
@@ -2116 +2148 @@
                                         'enum'        => array_keys( get_post_stati( array( 'internal' => false ) ) ),
                                         'context'     => array( 'view', 'edit' ),
+                                        'arg_options' => array(
+                                                'validate_callback' => array( $this, 'check_status' ),
+                                        ),
                                 ),
                                 'type'         => array(

trunk/tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -1005 +1005 @@
                 $request->set_param( 'post', $attachment_id );
                 $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+        }
+
+        /**
+         * @ticket 40399
+         */
+        public function test_update_item_with_existing_inherit_status() {
+                wp_set_current_user( self::$editor_id );
+                $parent_id     = self::factory()->post->create( array() );
+                $attachment_id = self::factory()->attachment->create_object(
+                        $this->test_file,
+                        $parent_id,
+                        array(
+                                'post_mime_type' => 'image/jpeg',
+                                'post_excerpt'   => 'A sample caption',
+                                'post_author'    => self::$editor_id,
+                        )
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/media/' . $attachment_id );
+                $request->set_param( 'status', 'inherit' );
+                $response = rest_get_server()->dispatch( $request );
+
+                $this->assertNotWPError( $response->as_error() );
+                $this->assertEquals( 'inherit', $response->get_data()['status'] );
+        }
+
+        /**
+         * @ticket 40399
+         */
+        public function test_update_item_with_new_inherit_status() {
+                wp_set_current_user( self::$editor_id );
+                $attachment_id = self::factory()->attachment->create_object(
+                        $this->test_file,
+                        0,
+                        array(
+                                'post_mime_type' => 'image/jpeg',
+                                'post_excerpt'   => 'A sample caption',
+                                'post_author'    => self::$editor_id,
+                                'post_status'    => 'private',
+                        )
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/media/' . $attachment_id );
+                $request->set_param( 'status', 'inherit' );
+                $response = rest_get_server()->dispatch( $request );
+
                 $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
         }