Changeset 50717

Timestamp:

04/14/2021 11:22:07 PM (3 years ago)

Author:

desrosj

Message:

REST API: Allow authors to read their own password protected posts.

Allow authenticated users to read the contents of password protected posts if they have the edit_post meta capability for the post.

Props xknown, zieladam, peterwilsoncc, swissspidy, timothyblynjacobs.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (8 diffs)
• tests/phpunit/tests/rest-api/rest-posts-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -31 +31 @@
      */
     protected $meta;
+
+    /**
+     * Passwordless post access permitted.
+     *
+     * @since 5.7.1
+     * @var int[]
+     */
+    protected $password_check_passed = array();
 
     /**
@@ -150 +158 @@
 
     /**
+     * Override the result of the post password check for REST requested posts.
+     *
+     * Allow users to read the content of password protected posts if they have
+     * previously passed a permission check or if they have the `edit_post` capability
+     * for the post being checked.
+     *
+     * @since 5.7.1
+     *
+     * @param bool    $required Whether the post requires a password check.
+     * @param WP_Post $post     The post been password checked.
+     * @return bool Result of password check taking in to account REST API considerations.
+     */
+    public function check_password_required( $required, $post ) {
+        if ( ! $required ) {
+            return $required;
+        }
+
+        $post = get_post( $post );
+
+        if ( ! $post ) {
+            return $required;
+        }
+
+        if ( ! empty( $this->password_check_passed[ $post->ID ] ) ) {
+            // Password previously checked and approved.
+            return false;
+        }
+
+        return ! current_user_can( 'edit_post', $post->ID );
+    }
+
+    /**
      * Retrieves a collection of posts.
      *
@@ -315 +355 @@
         // Allow access to all password protected posts if the context is edit.
         if ( 'edit' === $request['context'] ) {
-            add_filter( 'post_password_required', '__return_false' );
+            add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
         }
 
@@ -331 +371 @@
         // Reset filter.
         if ( 'edit' === $request['context'] ) {
-            remove_filter( 'post_password_required', '__return_false' );
+            remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
         }
 
@@ -446 +486 @@
         // Allow access to all password protected posts if the context is edit.
         if ( 'edit' === $request['context'] ) {
-            add_filter( 'post_password_required', '__return_false' );
+            add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
         }
 
@@ -474 +514 @@
         }
 
-        // Edit context always gets access to password-protected posts.
-        if ( 'edit' === $request['context'] ) {
+        /*
+         * Users always gets access to password protected content in the edit
+         * context if they have the `edit_post` meta capability.
+         */
+        if (
+            'edit' === $request['context'] &&
+            current_user_can( 'edit_post', $post->ID )
+        ) {
             return true;
         }
@@ -1729 +1775 @@
 
         if ( $this->can_access_password_content( $post, $request ) ) {
+            $this->password_check_passed[ $post->ID ] = true;
             // Allow access to the post, permissions already checked before.
-            add_filter( 'post_password_required', '__return_false' );
+            add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
 
             $has_password_filter = true;
@@ -1768 +1815 @@
         if ( $has_password_filter ) {
             // Reset filter.
-            remove_filter( 'post_password_required', '__return_false' );
+            remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
         }
 

trunk/tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -1819 +1819 @@
 
         $this->assertErrorResponse( 'rest_forbidden', $response, 401 );
+    }
+
+    public function test_get_post_draft_edit_context() {
+        $post_content = 'Hello World!';
+        $this->factory->post->create(
+            array(
+                'post_title'    => 'Hola',
+                'post_password' => 'password',
+                'post_content'  => $post_content,
+                'post_excerpt'  => $post_content,
+                'post_author'   => self::$editor_id,
+            )
+        );
+        $draft_id = $this->factory->post->create(
+            array(
+                'post_status'  => 'draft',
+                'post_author'  => self::$contributor_id,
+                'post_content' => '<!-- wp:latest-posts {"displayPostContent":true} /--> <!-- wp:latest-posts {"displayPostContent":true,"displayPostContentRadio":"full_post"} /-->',
+            )
+        );
+        wp_set_current_user( self::$contributor_id );
+        $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', $draft_id ) );
+        $request->set_param( 'context', 'edit' );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+        $this->assertNotContains( $post_content, $data['content']['rendered'] );
     }