Changeset 63708 for branches/5.4/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

Timestamp:

09/17/2026 09:05:55 PM (6 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 5.4 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• Comments: Enforce target post permissions when updating notes via REST.
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Themes: Escape the theme installer preview route value.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63658, r63659, r63660, r63665, r63669, r63672, r63675 to the 5.4 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, adamsilverstein, ramonopoly, villanovachile, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/5.4

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (3 diffs)

branches/5.4/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -769 +769 @@
          *
          * @since 4.7.0
+         * @since 7.1.0 Target post permissions are checked when a comment's parent post is changed.
          *
          * @param WP_REST_Request $request Full details about the request.
@@ -785 +786 @@
                                 array( 'status' => rest_authorization_required_code() )
                         );
+                }
+
+                /*
+                 * check_edit_permission() above only establishes that the comment may be
+                 * edited where it currently sits, because 'edit_comment' maps to 'edit_post'
+                 * on the comment's current parent. When the parent is being changed, the new
+                 * parent has to be authorized as well. Without this, a user holding
+                 * edit_comment on their own comment could reparent it onto any post,
+                 * including posts they can neither read nor edit.
+                 */
+                if ( isset( $request['post'] ) && (int) $request['post'] !== (int) $comment->comment_post_ID ) {
+                        $target_check = $this->check_target_post_permission( (int) $request['post'] );
+
+                        if ( is_wp_error( $target_check ) ) {
+                                return $target_check;
+                        }
                 }
 
@@ -1869 +1886 @@
                 return $email;
         }
+
+        /**
+         * Checks that a post can receive a comment from the current user.
+         *
+         * Used when changing the parent post of an existing comment, so that
+         * attaching a comment to a post is authorized the same way whichever
+         * path it arrives by.
+         *
+         * @since 7.1.0
+         *
+         * @param int $post_id Target post ID.
+         * @return true|WP_Error True if the post can receive the comment, error object otherwise.
+         */
+        protected function check_target_post_permission( $post_id ) {
+                if ( ! $post_id ) {
+                        return new WP_Error(
+                                'rest_comment_invalid_post_id',
+                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
+                                array( 'status' => 403 )
+                        );
+                }
+
+                /*
+                 * A comment needs either comment moderation rights or edit access to the
+                 * post, which is what check_edit_permission() grants on the post a comment
+                 * is moving away from. Requiring the same at the destination means both
+                 * ends of a move are authorized alike.
+                 */
+                if ( ! current_user_can( 'moderate_comments' ) && ! current_user_can( 'edit_post', $post_id ) ) {
+                        return new WP_Error(
+                                'rest_cannot_edit',
+                                __( 'Sorry, you are not allowed to edit this comment.' ),
+                                array( 'status' => rest_authorization_required_code() )
+                        );
+                }
+
+                $post = get_post( $post_id );
+
+                if ( ! $post ) {
+                        return new WP_Error(
+                                'rest_comment_invalid_post_id',
+                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
+                                array( 'status' => 403 )
+                        );
+                }
+
+                /*
+                 * The create-time draft and comments-open rules are deliberately not applied
+                 * here, because moderators move comments onto posts whose discussion has
+                 * closed and onto drafts today. Enforcing them would break that without
+                 * blocking anything the capability check above already permits.
+                 */
+                return true;
+        }
 }