Changeset 63912

Timestamp:

09/24/2026 05:30:50 AM (4 days ago)

Author:

ramonopoly

Message:

REST API: Check for a missing post before the comment status capability.

WP_REST_Comments_Controller::create_item_permissions_check() used to check whether the caller was allowed to set the status parameter before it checked that a post was supplied at all.

A request that carried a status but no post was therefore rejected with rest_comment_invalid_status, "Sorry, you are not allowed to edit 'status' for comments", which points at the wrong parameter. The actual problem was the missing post.

This commit moves the missing-post guard above the status capability check. No logic changes.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12764

Props ramonopoly, andrewserong, mukesh27.

Fixes #65761.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/rest-comments-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -569 +569 @@
                 }
 
+                if ( empty( $request['post'] ) ) {
+                        return new WP_Error(
+                                'rest_comment_invalid_post_id',
+                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
+                                array( 'status' => 403 )
+                        );
+                }
+
                 $edit_cap = $is_note ? array( 'edit_post', (int) $request['post'] ) : array( 'moderate_comments' );
                 if ( isset( $request['status'] ) && ! current_user_can( ...$edit_cap ) ) {
@@ -576 +584 @@
                                 sprintf( __( "Sorry, you are not allowed to edit '%s' for comments." ), 'status' ),
                                 array( 'status' => rest_authorization_required_code() )
-                        );
-                }
-
-                if ( empty( $request['post'] ) ) {
-                        return new WP_Error(
-                                'rest_comment_invalid_post_id',
-                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
-                                array( 'status' => 403 )
                         );
                 }

trunk/tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -2025 +2025 @@
         }
 
+        /**
+         * A missing post should be reported as a missing post, even when the request
+         * also sets `status` and the user is not allowed to set it.
+         *
+         * @ticket 65761
+         */
+        public function test_create_comment_status_and_no_post_id_no_permission() {
+                wp_set_current_user( self::$author_id );
+
+                $params = array(
+                        'author_name'  => 'Homer Jay Simpson',
+                        'author_email' => 'chunkylover53@aol.com',
+                        'author_url'   => 'http://compuglobalhypermeganet.com',
+                        'content'      => 'Here\’s to alcohol: the cause of, and solution to, all of life\’s problems.',
+                        'status'       => 'approved',
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/comments' );
+                $request->add_header( 'Content-Type', 'application/json' );
+                $request->set_body( wp_json_encode( $params ) );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_comment_invalid_post_id', $response, 403 );
+        }
+
         public function test_create_comment_invalid_post_id() {
                 wp_set_current_user( self::$admin_id );
@@ -3815 +3840 @@
 
         /**
+         * A missing post should be reported as a missing post for notes too.
+         *
+         * Without a post, the `status` capability check falls back to
+         * `current_user_can( 'edit_post', 0 )`, which no role can satisfy. An
+         * administrator is used here to show the missing post is reported even for a
+         * user holding every capability.
+         *
+         * @ticket 65761
+         */
+        public function test_create_note_status_and_no_post_id() {
+                wp_set_current_user( self::$admin_id );
+
+                $params = array(
+                        'author_name'  => 'Ishmael',
+                        'author_email' => 'herman-melville@earthlink.net',
+                        'author_url'   => 'https://en.wikipedia.org/wiki/Herman_Melville',
+                        'content'      => 'Comic Book Guy',
+                        'type'         => 'note',
+                        'status'       => 'hold',
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/comments' );
+                $request->add_header( 'Content-Type', 'application/json' );
+                $request->set_body( wp_json_encode( $params ) );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertErrorResponse( 'rest_comment_invalid_post_id', $response, 403 );
+        }
+
+        /**
          * @ticket 64096
          */