Changeset 56075

Timestamp:

06/27/2023 05:24:44 PM (19 months ago)

Author:

kadamwhite

Message:

REST API: Check post meta update authorization only when value is changed.

Resolves a bug where a post save will be reported as failed if the post includes any meta keys the current user does not have authorization to update, even when those meta values are unchanged.
Write authorization is now checked for a meta key only when the value of that key has changed, so that passing a REST response back unchanged will not cause failures.
Authorization is only needed when data will be updated.

Props ckoerner, TimothyBlynJacobs, spacedmonkey

Location:

trunk

Files:

• src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/rest-post-meta-fields.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php

@@ -369 +369 @@
         $meta_type = $this->get_meta_type();
 
+        // Do the exact same check for a duplicate value as in update_metadata() to avoid update_metadata() returning false.
+        $old_value = get_metadata( $meta_type, $object_id, $meta_key );
+        $subtype   = get_object_subtype( $meta_type, $object_id );
+
+        if ( is_array( $old_value ) && 1 === count( $old_value )
+            && $this->is_meta_value_same_as_stored_value( $meta_key, $subtype, $old_value[0], $value )
+        ) {
+            return true;
+        }
+
         if ( ! current_user_can( "edit_{$meta_type}_meta", $object_id, $meta_key ) ) {
             return new WP_Error(
@@ -379 +389 @@
                 )
             );
-        }
-
-        // Do the exact same check for a duplicate value as in update_metadata() to avoid update_metadata() returning false.
-        $old_value = get_metadata( $meta_type, $object_id, $meta_key );
-        $subtype   = get_object_subtype( $meta_type, $object_id );
-
-        if ( is_array( $old_value ) && 1 === count( $old_value )
-            && $this->is_meta_value_same_as_stored_value( $meta_key, $subtype, $old_value[0], $value )
-        ) {
-            return true;
         }
 

trunk/tests/phpunit/tests/rest-api/rest-post-meta-fields.php

@@ -2301 +2301 @@
 
     /**
+     * @ticket 57745
+     */
+    public function test_update_meta_with_unchanged_values_and_custom_authentication() {
+        register_post_meta(
+            'post',
+            'authenticated',
+            array(
+                'single'        => true,
+                'type'          => 'boolean',
+                'default'       => false,
+                'show_in_rest'  => true,
+                'auth_callback' => '__return_false',
+            )
+        );
+
+        add_post_meta( self::$post_id, 'authenticated', false );
+
+        $this->grant_write_permission();
+
+        $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+        $request->set_body_params(
+            array(
+                'meta' => array(
+                    'authenticated' => false,
+                ),
+            )
+        );
+
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertSame( 200, $response->get_status() );
+
+        $data = $response->get_data();
+        $this->assertSame( false, $data['meta']['authenticated'] );
+    }
+
+    /**
      * @ticket 43392
      */