Changeset 57222 for trunk/tests/phpunit/tests/rest-api/rest-revisions-controller.php

Timestamp:

12/22/2023 02:10:18 AM (12 months ago)

Author:

isabel_brison

Message:

REST API: check parent and revision ids match before retrieving revision.

Adds a condition to check that parent id matches revision parent id in WP_REST_Revisions_Controller get_item method.

Props ramonopoly, adamsilverstein, danielbachhuber, spacedmonkey, andrewserong.
Fixes #59875.

File:

• trunk/tests/phpunit/tests/rest-api/rest-revisions-controller.php (modified) (7 diffs)

trunk/tests/phpunit/tests/rest-api/rest-revisions-controller.php

@@ -10 +10 @@
 class WP_Test_REST_Revisions_Controller extends WP_Test_REST_Controller_Testcase {
     protected static $post_id;
+    protected static $post_id_2;
     protected static $page_id;
 
@@ -23 +24 @@
     private $revision_3;
     private $revision_id3;
+    private $revision_2_1_id;
 
     public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
-        self::$post_id = $factory->post->create();
-        self::$page_id = $factory->post->create( array( 'post_type' => 'page' ) );
+        self::$post_id   = $factory->post->create();
+        self::$post_id_2 = $factory->post->create();
+        self::$page_id   = $factory->post->create( array( 'post_type' => 'page' ) );
 
         self::$editor_id      = $factory->user->create(
@@ -56 +59 @@
                 'post_content' => 'This content is fantastic.',
                 'ID'           => self::$post_id,
+            )
+        );
+        wp_update_post(
+            array(
+                'post_content' => 'A second post.',
+                'ID'           => self::$post_id_2,
+            )
+        );
+        wp_update_post(
+            array(
+                'post_content' => 'A second post. How prolific.',
+                'ID'           => self::$post_id_2,
             )
         );
@@ -64 +79 @@
         // Also deletes revisions.
         wp_delete_post( self::$post_id, true );
+        wp_delete_post( self::$post_id_2, true );
         wp_delete_post( self::$page_id, true );
 
@@ -73 +89 @@
         parent::set_up();
 
+        // Set first post revision vars.
         $revisions             = wp_get_post_revisions( self::$post_id );
         $this->total_revisions = count( $revisions );
@@ -82 +99 @@
         $this->revision_3      = array_pop( $revisions );
         $this->revision_id3    = $this->revision_3->ID;
+
+        // Set second post revision vars.
+        $revisions             = wp_get_post_revisions( self::$post_id_2 );
+        $post_2_revision       = array_pop( $revisions );
+        $this->revision_2_1_id = $post_2_revision->ID;
     }
 
@@ -233 +255 @@
         $response = rest_get_server()->dispatch( $request );
         $this->assertErrorResponse( 'rest_post_invalid_parent', $response, 404 );
+    }
+
+    /**
+     * @ticket 59875
+     */
+    public function test_get_item_valid_parent_id() {
+        wp_set_current_user( self::$editor_id );
+        $request  = new WP_REST_Request( 'GET', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_id1 );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+        $this->assertSame( self::$post_id, $data['parent'], "The returned revision's id should match the parent id." );
+        $this->check_get_revision_response( $response, $this->revision_1 );
+    }
+
+    /**
+     * @ticket 59875
+     */
+    public function test_get_item_invalid_parent_id() {
+        wp_set_current_user( self::$editor_id );
+        $request  = new WP_REST_Request( 'GET', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_2_1_id );
+        $response = rest_get_server()->dispatch( $request );
+        $this->assertErrorResponse( 'rest_revision_parent_id_mismatch', $response, 404 );
+
+        $expected_message = 'The revision does not belong to the specified parent with id of "' . self::$post_id . '"';
+        $this->assertSame( $expected_message, $response->as_error()->get_error_messages()[0], 'The message must contain the correct parent ID.' );
     }