Changeset 60834 for branches/5.2/tests/phpunit/tests/rest-api/rest-posts-controller.php

Timestamp:

09/30/2025 05:05:21 PM (12 months ago)

Author:

desrosj

Message:

Grouped backports for the 5.2 branch.

• REST API: Increase the specificity of capability checks for collections when the edit context is in use.
• Menus: Prevent HTML in menu item titles from being rendered unexpectedly.

Merges [60814], [60815], [60816] to the 5.2 branch.

Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam.

Location:

branches/5.2

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/rest-api/rest-posts-controller.php (modified) (1 diff)

branches/5.2/tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -4314 +4314 @@
 
         /**
+         * @group 1018470
+         */
+        public function test_cannot_get_other_users_single_post_with_edit_context_if_disallowed() {
+                $author_post = self::factory()->post->create(
+                        array(
+                                'post_password' => 'test',
+                                'post_author'   => self::$author_id,
+                        )
+                );
+
+                wp_set_current_user( self::$contributor_id );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts/' . $author_post );
+                $request->set_query_params( array( 'context' => 'edit' ) );
+                $response = rest_do_request( $request );
+
+                $this->assertErrorResponse( 'rest_forbidden_context', $response, 403, 'Contributor should not be able to access Author post with edit context' );
+        }
+
+        /**
+         * @group 1018470
+         */
+        public function test_cannot_see_other_users_post_in_collection_with_edit_context_if_disallowed() {
+                $author_post = self::factory()->post->create(
+                        array(
+                                'post_password' => 'test',
+                                'post_author'   => self::$author_id,
+                        )
+                );
+
+                wp_set_current_user( self::$contributor_id );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+                $request->set_query_params(
+                        array(
+                                'context' => 'edit',
+                                'include' => $author_post,
+                        )
+                );
+                $response = rest_do_request( $request );
+                $data     = $response->get_data();
+
+                $this->assertIsArray( $data );
+                $this->assertEmpty( $data );
+        }
+
+        /**
          * Internal function used to disable an insert query which
          * will trigger a wpdb error for testing purposes.