Changeset 60834 for branches/5.2/tests/phpunit/tests/rest-api/rest-tags-controller.php

Timestamp:

09/30/2025 05:05:21 PM (11 months ago)

Author:

desrosj

Message:

Grouped backports for the 5.2 branch.

• REST API: Increase the specificity of capability checks for collections when the edit context is in use.
• Menus: Prevent HTML in menu item titles from being rendered unexpectedly.

Merges [60814], [60815], [60816] to the 5.2 branch.

Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam.

Location:

branches/5.2

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/rest-api/rest-tags-controller.php (modified) (1 diff)

branches/5.2/tests/phpunit/tests/rest-api/rest-tags-controller.php

@@ -1270 +1270 @@
         }
 
+        /**
+         * @group 1018470
+         */
+        public function test_cannot_get_single_term_with_edit_context_if_disallowed() {
+                add_filter(
+                        'map_meta_cap',
+                        static function ( $caps, $cap ) {
+                                if ( 'edit_term' === $cap ) {
+                                        return array( 'do_not_allow' );
+                                }
+
+                                return $caps;
+                        },
+                        10,
+                        2
+                );
+
+                $term = self::factory()->term->create();
+
+                wp_set_current_user( self::$editor );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/tags/' . $term );
+                $request->set_query_params( array( 'context' => 'edit' ) );
+                $response = rest_do_request( $request );
+                $this->assertErrorResponse( 'rest_forbidden_context', $response, 403 );
+        }
+
+        /**
+         * @group 1018470
+         */
+        public function test_cannot_see_single_term_in_collection_with_edit_context_if_disallowed() {
+                add_filter(
+                        'map_meta_cap',
+                        static function ( $caps, $cap ) {
+                                if ( 'edit_term' === $cap ) {
+                                        return array( 'do_not_allow' );
+                                }
+
+                                return $caps;
+                        },
+                        10,
+                        2
+                );
+
+                $term = self::factory()->term->create();
+
+                wp_set_current_user( self::$editor );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/tags' );
+                $request->set_query_params(
+                        array(
+                                'context' => 'edit',
+                                'include' => $term,
+                        )
+                );
+                $response = rest_do_request( $request );
+                $data     = $response->get_data();
+
+                $this->assertIsArray( $data );
+                $this->assertEmpty( $data );
+        }
+
         public function additional_field_get_callback( $object, $request ) {
                 return 123;