Changeset 50730

Timestamp:

04/15/2021 01:09:07 AM (5 years ago)

Author:

peterwilsoncc

Message:

Grouped merges for 5.1.9.

• REST API: Allow authors to read their own password protected posts.
• About page update

Merges [50717] to the 5.1 branch.

Location:

branches/5.1

Files:

• src/wp-admin/about.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (8 diffs)
• tests/phpunit/tests/rest-api/rest-posts-controller.php (modified) (1 diff)

branches/5.1/src/wp-admin/about.php

@@ -37 +37 @@
                 <div class="changelog point-releases">
                         <h3><?php _e( 'Maintenance and Security Releases' ); ?></h3>
+                        <p>
+                                <?php
+                                printf(
+                                        /* translators: %s: WordPress version number */
+                                        __( '<strong>Version %s</strong> addressed some security issues.' ),
+                                        '5.1.9'
+                                );
+                                ?>
+                                <?php
+                                printf(
+                                        /* translators: %s: HelpHub URL */
+                                        __( 'For more information, see <a href="%s">the release notes</a>.' ),
+                                        sprintf(
+                                                /* translators: %s: WordPress version */
+                                                esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+                                                sanitize_title( '5.1.9' )
+                                        )
+                                );
+                                ?>
+                        </p>
                         <p>
                                 <?php

branches/5.1/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -32 +32 @@
          */
         protected $meta;
+
+        /**
+         * Passwordless post access permitted.
+         *
+         * @since 5.7.1
+         * @var int[]
+         */
+        protected $password_check_passed = array();
 
         /**
@@ -144 +152 @@
 
                 return true;
+        }
+
+        /**
+         * Override the result of the post password check for REST requested posts.
+         *
+         * Allow users to read the content of password protected posts if they have
+         * previously passed a permission check or if they have the `edit_post` capability
+         * for the post being checked.
+         *
+         * @since 5.7.1
+         *
+         * @param bool    $required Whether the post requires a password check.
+         * @param WP_Post $post     The post been password checked.
+         * @return bool Result of password check taking in to account REST API considerations.
+         */
+        public function check_password_required( $required, $post ) {
+                if ( ! $required ) {
+                        return $required;
+                }
+
+                $post = get_post( $post );
+
+                if ( ! $post ) {
+                        return $required;
+                }
+
+                if ( ! empty( $this->password_check_passed[ $post->ID ] ) ) {
+                        // Password previously checked and approved.
+                        return false;
+                }
+
+                return ! current_user_can( 'edit_post', $post->ID );
         }
 
@@ -301 +341 @@
                 // Allow access to all password protected posts if the context is edit.
                 if ( 'edit' === $request['context'] ) {
-                        add_filter( 'post_password_required', '__return_false' );
+                        add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
                 }
 
@@ -317 +357 @@
                 // Reset filter.
                 if ( 'edit' === $request['context'] ) {
-                        remove_filter( 'post_password_required', '__return_false' );
+                        remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
                 }
 
@@ -415 +455 @@
                 // Allow access to all password protected posts if the context is edit.
                 if ( 'edit' === $request['context'] ) {
-                        add_filter( 'post_password_required', '__return_false' );
+                        add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
                 }
 
@@ -443 +483 @@
                 }
 
-                // Edit context always gets access to password-protected posts.
-                if ( 'edit' === $request['context'] ) {
+                /*
+                 * Users always gets access to password protected content in the edit
+                 * context if they have the `edit_post` meta capability.
+                 */
+                if (
+                        'edit' === $request['context'] &&
+                        current_user_can( 'edit_post', $post->ID )
+                ) {
                         return true;
                 }
@@ -1520 +1566 @@
 
                 if ( $this->can_access_password_content( $post, $request ) ) {
+                        $this->password_check_passed[ $post->ID ] = true;
                         // Allow access to the post, permissions already checked before.
-                        add_filter( 'post_password_required', '__return_false' );
+                        add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
 
                         $has_password_filter = true;
@@ -1548 +1595 @@
                 if ( $has_password_filter ) {
                         // Reset filter.
-                        remove_filter( 'post_password_required', '__return_false' );
+                        remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
                 }
 

branches/5.1/tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -1430 +1430 @@
 
                 $this->assertErrorResponse( 'rest_forbidden', $response, 401 );
+        }
+
+        public function test_get_post_draft_edit_context() {
+                $post_content = 'Hello World!';
+                $this->factory->post->create(
+                        array(
+                                'post_title'    => 'Hola',
+                                'post_password' => 'password',
+                                'post_content'  => $post_content,
+                                'post_excerpt'  => $post_content,
+                                'post_author'   => self::$editor_id,
+                        )
+                );
+                $draft_id = $this->factory->post->create(
+                        array(
+                                'post_status'  => 'draft',
+                                'post_author'  => self::$contributor_id,
+                                'post_content' => '<!-- wp:latest-posts {"displayPostContent":true} /--> <!-- wp:latest-posts {"displayPostContent":true,"displayPostContentRadio":"full_post"} /-->',
+                        )
+                );
+                wp_set_current_user( self::$contributor_id );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', $draft_id ) );
+                $request->set_param( 'context', 'edit' );
+                $response = rest_get_server()->dispatch( $request );
+                $data     = $response->get_data();
+                $this->assertNotContains( $post_content, $data['content']['rendered'] );
         }