Changeset 63912 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

Timestamp:

09/24/2026 05:30:50 AM (4 days ago)

Author:

ramonopoly

Message:

REST API: Check for a missing post before the comment status capability.

WP_REST_Comments_Controller::create_item_permissions_check() used to check whether the caller was allowed to set the status parameter before it checked that a post was supplied at all.

A request that carried a status but no post was therefore rejected with rest_comment_invalid_status, "Sorry, you are not allowed to edit 'status' for comments", which points at the wrong parameter. The actual problem was the missing post.

This commit moves the missing-post guard above the status capability check. No logic changes.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12764

Props ramonopoly, andrewserong, mukesh27.

Fixes #65761.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -569 +569 @@
                 }
 
+                if ( empty( $request['post'] ) ) {
+                        return new WP_Error(
+                                'rest_comment_invalid_post_id',
+                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
+                                array( 'status' => 403 )
+                        );
+                }
+
                 $edit_cap = $is_note ? array( 'edit_post', (int) $request['post'] ) : array( 'moderate_comments' );
                 if ( isset( $request['status'] ) && ! current_user_can( ...$edit_cap ) ) {
@@ -576 +584 @@
                                 sprintf( __( "Sorry, you are not allowed to edit '%s' for comments." ), 'status' ),
                                 array( 'status' => rest_authorization_required_code() )
-                        );
-                }
-
-                if ( empty( $request['post'] ) ) {
-                        return new WP_Error(
-                                'rest_comment_invalid_post_id',
-                                __( 'Sorry, you are not allowed to create this comment without a post.' ),
-                                array( 'status' => 403 )
                         );
                 }