Changeset 49380

Timestamp:

10/29/2020 05:42:13 PM (4 years ago)

Author:

desrosj

Message:

XML-RPC: Improve error messages for unprivileged users.

Add specific permission checks to avoid ambiguous failure messages.

Props zieladam, peterwilsoncc, xknown, whyisjake.

Location:

trunk

Files:

• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)
• tests/phpunit/tests/xmlrpc/wp/newComment.php (modified) (11 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3877 +3877 @@
         }
 
+        if (
+            'publish' === get_post_status( $post_id ) &&
+            ! current_user_can( 'edit_post', $post_id ) &&
+            post_password_required( $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
+        if (
+            'private' === get_post_status( $post_id ) &&
+            ! current_user_can( 'read_post', $post_id )
+        ) {
+            return new IXR_Error( 403, __( 'Sorry, you are not allowed to comment on this post.' ) );
+        }
+
         $comment = array(
             'comment_post_ID' => $post_id,

trunk/tests/phpunit/tests/xmlrpc/wp/newComment.php

@@ -7 +7 @@
 
     /**
-     * Post object for shared fixture.
-     *
-     * @var WP_Post
-     */
-    public static $post;
+     * Array of posts.
+     *
+     * @var WP_Post[]
+     */
+    public static $posts;
+
+    /**
+     * User IDs.
+     *
+     * Array of user IDs keyed by role.
+     *
+     * @var int[]
+     */
+    public static $user_ids;
 
     public static function wpSetUpBeforeClass( $factory ) {
-        self::make_user_by_role( 'administrator' );
-        self::$post = $factory->post->create_and_get();
+        self::$user_ids                     = array(
+            'administrator' => self::make_user_by_role( 'administrator' ),
+            'contributor'   => self::make_user_by_role( 'contributor' ),
+        );
+        self::$posts['publish']             = $factory->post->create_and_get();
+        self::$posts['password']            = $factory->post->create_and_get(
+            array(
+                'post_password' => 'xmlrpc',
+                'post_author'   => self::$user_ids['administrator'],
+            )
+        );
+        self::$posts['private']             = $factory->post->create_and_get(
+            array(
+                'post_status' => 'private',
+                'post_author' => self::$user_ids['administrator'],
+            )
+        );
+        self::$posts['private_contributor'] = $factory->post->create_and_get(
+            array(
+                'post_status' => 'private',
+                'post_author' => self::$user_ids['contributor'],
+            )
+        );
     }
 
@@ -24 +54 @@
                 'administrator',
                 'administrator',
-                self::$post->ID,
+                self::$posts['publish']->ID,
                 array(
                     'content' => rand_str( 100 ),
@@ -40 +70 @@
                 'administrator',
                 'administrator',
-                self::$post->ID,
+                self::$posts['publish']->ID,
                 array(
                     'content' => '',
@@ -60 +90 @@
                 'administrator',
                 'administrator',
-                self::$post->ID,
+                self::$posts['publish']->ID,
                 array(
                     'content' => '   ',
@@ -80 +110 @@
                 'administrator',
                 'administrator',
-                self::$post->ID,
+                self::$posts['publish']->ID,
                 array(
                     'content' => '0',
@@ -100 +130 @@
                 'administrator',
                 'administrator',
-                self::$post->ID,
+                self::$posts['publish']->ID,
                 array(
                     'content' => '   ',
@@ -140 +170 @@
             'administrator',
             'administrator',
-            self::$post->ID,
+            self::$posts['publish']->ID,
             array(
                 'content' => rand_str( 100 ),
@@ -169 +199 @@
             '',
             '',
-            self::$post->ID,
+            self::$posts['publish']->ID,
             array(
                 'author'       => 'WordPress',
@@ -194 +224 @@
             '',
             '',
-            self::$post->ID,
+            self::$posts['publish']->ID,
             array(
                 'author'       => 'WordPress',
@@ -219 +249 @@
             'administrator',
             'administrator',
-            self::$post->ID,
+            self::$posts['publish']->ID,
             array(
                 'author'       => 'WordPress',
@@ -233 +263 @@
         $this->assertSame( $user_id, (int) $comment->user_id );
     }
+
+    /**
+     * Ensure users can only comment on posts they're permitted to access.
+     *
+     * @dataProvider data_comments_observe_post_permissions
+     *
+     * @param string $post_key      Post identifier from the self::$posts array.
+     * @param string $username      Username leaving comment.
+     * @param bool   $expected      Expected result. True: successfull comment. False: Refused comment.
+     * @param string $anon_callback Optional. Allow anonymous comment callback. Default __return_false.
+     */
+    function test_comments_observe_post_permissions( $post_key, $username, $expected, $anon_callback = '__return_false' ) {
+        add_filter( 'xmlrpc_allow_anonymous_comments', $anon_callback );
+
+        $comment_args = array(
+            1,
+            $username,
+            $username,
+            self::$posts[ $post_key ]->ID,
+            array(
+                'author'       => 'WordPress',
+                'author_email' => 'noreply@wordpress.org',
+                'content'      => 'Test Comment',
+            ),
+        );
+
+        $result = $this->myxmlrpcserver->wp_newComment( $comment_args );
+        if ( $expected ) {
+            $this->assertInternalType( 'int', $result );
+            return;
+        }
+
+        $this->assertIXRError( $result );
+        $this->assertSame( 403, $result->code );
+    }
+
+    /**
+     * Data provider for test_comments_observe_post_permissions.
+     *
+     * @return array[] {
+     *     @type string Post identifier from the self::$posts array.
+     *     @type string Username leaving comment.
+     *     @type bool   Expected result. True: successfull comment. False: Refused comment.
+     *     @type string Optional. Allow anonymous comment callback. Default __return_false.
+     * }
+     */
+    function data_comments_observe_post_permissions() {
+        return array(
+            // 0: Post author, password protected public post.
+            array(
+                'password',
+                'administrator',
+                true,
+            ),
+            // 1: Low privileged non-author, password protected public post.
+            array(
+                'password',
+                'contributor',
+                false,
+            ),
+            // 2: Anonymous user, password protected public post.
+            array(
+                'password',
+                '', // Anonymous user.
+                false,
+            ),
+            // 3: Anonymous user, anon comments allowed, password protected public post.
+            array(
+                'password',
+                '', // Anonymous user.
+                false,
+                '__return_true',
+            ),
+
+            // 4: Post author, private post.
+            array(
+                'private',
+                'administrator',
+                true,
+            ),
+            // 5: Low privileged non-author, private post.
+            array(
+                'private',
+                'contributor',
+                false,
+            ),
+            // 6: Anonymous user, private post.
+            array(
+                'private',
+                '', // Anonymous user.
+                false,
+            ),
+            // 7: Anonymous user, anon comments allowed, private post.
+            array(
+                'private',
+                '', // Anonymous user.
+                false,
+                '__return_true',
+            ),
+
+            // 8: High privileged non-author, private post.
+            array(
+                'private_contributor',
+                'administrator',
+                true,
+            ),
+            // 9: Low privileged author, private post.
+            array(
+                'private_contributor',
+                'contributor',
+                true,
+            ),
+            // 10: Anonymous user, private post.
+            array(
+                'private_contributor',
+                '', // Anonymous user.
+                false,
+            ),
+            // 11: Anonymous user, anon comments allowed, private post.
+            array(
+                'private_contributor',
+                '', // Anonymous user.
+                false,
+                '__return_true',
+            ),
+        );
+    }
 }