Changeset 57222

Timestamp:

12/22/2023 02:10:18 AM (3 years ago)

Author:

isabel_brison

Message:

REST API: check parent and revision ids match before retrieving revision.

Adds a condition to check that parent id matches revision parent id in WP_REST_Revisions_Controller get_item method.

Props ramonopoly, adamsilverstein, danielbachhuber, spacedmonkey, andrewserong.
Fixes #59875.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/rest-revisions-controller.php (modified) (7 diffs)
• tests/phpunit/tests/rest-api/wpRestTemplateRevisionsController.php (modified) (4 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php

@@ -388 +388 @@
          *
          * @since 4.7.0
+         * @since 6.5.0 Added a condition to check that parent id matches revision parent id.
          *
          * @param WP_REST_Request $request Full details about the request.
@@ -401 +402 @@
                 if ( is_wp_error( $revision ) ) {
                         return $revision;
+                }
+
+                if ( (int) $parent->ID !== (int) $revision->post_parent ) {
+                        return new WP_Error(
+                                'rest_revision_parent_id_mismatch',
+                                /* translators: %d: A post id. */
+                                sprintf( __( 'The revision does not belong to the specified parent with id of "%d"' ), $parent->ID ),
+                                array( 'status' => 404 )
+                        );
                 }
 

trunk/tests/phpunit/tests/rest-api/rest-revisions-controller.php

@@ -10 +10 @@
 class WP_Test_REST_Revisions_Controller extends WP_Test_REST_Controller_Testcase {
         protected static $post_id;
+        protected static $post_id_2;
         protected static $page_id;
 
@@ -23 +24 @@
         private $revision_3;
         private $revision_id3;
+        private $revision_2_1_id;
 
         public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
-                self::$post_id = $factory->post->create();
-                self::$page_id = $factory->post->create( array( 'post_type' => 'page' ) );
+                self::$post_id   = $factory->post->create();
+                self::$post_id_2 = $factory->post->create();
+                self::$page_id   = $factory->post->create( array( 'post_type' => 'page' ) );
 
                 self::$editor_id      = $factory->user->create(
@@ -56 +59 @@
                                 'post_content' => 'This content is fantastic.',
                                 'ID'           => self::$post_id,
+                        )
+                );
+                wp_update_post(
+                        array(
+                                'post_content' => 'A second post.',
+                                'ID'           => self::$post_id_2,
+                        )
+                );
+                wp_update_post(
+                        array(
+                                'post_content' => 'A second post. How prolific.',
+                                'ID'           => self::$post_id_2,
                         )
                 );
@@ -64 +79 @@
                 // Also deletes revisions.
                 wp_delete_post( self::$post_id, true );
+                wp_delete_post( self::$post_id_2, true );
                 wp_delete_post( self::$page_id, true );
 
@@ -73 +89 @@
                 parent::set_up();
 
+                // Set first post revision vars.
                 $revisions             = wp_get_post_revisions( self::$post_id );
                 $this->total_revisions = count( $revisions );
@@ -82 +99 @@
                 $this->revision_3      = array_pop( $revisions );
                 $this->revision_id3    = $this->revision_3->ID;
+
+                // Set second post revision vars.
+                $revisions             = wp_get_post_revisions( self::$post_id_2 );
+                $post_2_revision       = array_pop( $revisions );
+                $this->revision_2_1_id = $post_2_revision->ID;
         }
 
@@ -233 +255 @@
                 $response = rest_get_server()->dispatch( $request );
                 $this->assertErrorResponse( 'rest_post_invalid_parent', $response, 404 );
+        }
+
+        /**
+         * @ticket 59875
+         */
+        public function test_get_item_valid_parent_id() {
+                wp_set_current_user( self::$editor_id );
+                $request  = new WP_REST_Request( 'GET', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_id1 );
+                $response = rest_get_server()->dispatch( $request );
+                $data     = $response->get_data();
+                $this->assertSame( self::$post_id, $data['parent'], "The returned revision's id should match the parent id." );
+                $this->check_get_revision_response( $response, $this->revision_1 );
+        }
+
+        /**
+         * @ticket 59875
+         */
+        public function test_get_item_invalid_parent_id() {
+                wp_set_current_user( self::$editor_id );
+                $request  = new WP_REST_Request( 'GET', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_2_1_id );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_revision_parent_id_mismatch', $response, 404 );
+
+                $expected_message = 'The revision does not belong to the specified parent with id of "' . self::$post_id . '"';
+                $this->assertSame( $expected_message, $response->as_error()->get_error_messages()[0], 'The message must contain the correct parent ID.' );
         }
 

trunk/tests/phpunit/tests/rest-api/wpRestTemplateRevisionsController.php

@@ -23 +23 @@
          * @var string
          */
+        const TEMPLATE_NAME_2 = 'my_template_2';
+
+        /**
+         * @var string
+         */
         const PARENT_POST_TYPE = 'wp_template';
 
@@ -51 +56 @@
          */
         private static $template_post;
+
+        /**
+         * Template post.
+         *
+         * @since 6.5.0
+         *
+         * @var WP_Post
+         */
+        private static $template_post_2;
 
         /**
@@ -124 +138 @@
                         )
                 );
+
+                // Create a new template post to test the get_item method.
+                self::$template_post_2 = $factory->post->create_and_get(
+                        array(
+                                'post_type'    => self::PARENT_POST_TYPE,
+                                'post_name'    => self::TEMPLATE_NAME_2,
+                                'post_title'   => 'My Template 2',
+                                'post_content' => 'Content 2',
+                                'post_excerpt' => 'Description of my template 2',
+                                'tax_input'    => array(
+                                        'wp_theme' => array(
+                                                self::TEST_THEME,
+                                        ),
+                                ),
+                        )
+                );
+                wp_set_post_terms( self::$template_post_2->ID, self::TEST_THEME, 'wp_theme' );
+
+                var_dump( self::$template_post->ID );
+                var_dump( self::$template_post_2->ID );
         }
 
@@ -335 +369 @@
                 $response = rest_get_server()->dispatch( $request );
                 $this->assertErrorResponse( 'rest_post_invalid_parent', $response, WP_Http::NOT_FOUND );
+        }
+
+        /**
+         * @ticket 59875
+         */
+        public function test_get_item_invalid_parent_id() {
+                wp_set_current_user( self::$admin_id );
+                $revisions   = wp_get_post_revisions( self::$template_post, array( 'fields' => 'ids' ) );
+                $revision_id = array_shift( $revisions );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/templates/' . self::TEST_THEME . '/' . self::TEMPLATE_NAME_2 . '/revisions/' . $revision_id );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_revision_parent_id_mismatch', $response, 404 );
+
+                $expected_message = 'The revision does not belong to the specified parent with id of "' . self::$template_post_2->ID . '"';
+                $this->assertSame( $expected_message, $response->as_error()->get_error_messages()[0], 'The message must contain the correct parent ID.' );
         }