Make WordPress Core


Ignore:
Timestamp:
10/30/2025 11:54:22 AM (3 months ago)
Author:
wildworks
Message:

Editor: Add auth_callback to _wp_note_status comment meta.

Adds an auth_callback to the _wp_note_status comment meta so that only users with the edit_comment capability can update this meta field via the REST API.

This is necessary to ensure that users can properly resolve or reopen Notes.

Props wildworks, adamsilverstein, westonruter, mamaduka, desrosj.
Fixes #64153.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

    r60987 r61089  
    171171        parent::set_up();
    172172        $this->endpoint = new WP_REST_Comments_Controller();
     173        wp_create_initial_comment_meta();
     174
    173175        if ( is_multisite() ) {
    174176            update_site_option( 'site_admins', array( 'superadmin' ) );
     
    38893891        $response = rest_get_server()->dispatch( $request );
    38903892        $this->assertSame( 201, $response->get_status() );
     3893
     3894        $data = $response->get_data();
     3895        $this->assertArrayHasKey( 'meta', $data );
     3896        $this->assertArrayHasKey( '_wp_note_status', $data['meta'] );
     3897        $this->assertSame( $status, $data['meta']['_wp_note_status'] );
    38913898    }
    38923899
Note: See TracChangeset for help on using the changeset viewer.