Unit tests for mt_publishPost, blogger_newPost and mw_newPost

[fgauthier]

The mt_publishPost function requires both the publish_posts and edit_post privileges to publish a post.

Elsewhere, the publish_posts privilege is sufficient to publish a post.

[markoheijnen]

If I look at _insert_post() what is used in the main XML-RPC methods you will see both checks there too.

Guess you mean that with elsewhere? or do you mean somewhere else in core?

[fgauthier]

In fact, I meant functions like blogger_newPost($args) and mw_newPost($args) that do not check the edit_post privilege when the status of the new post is set to 'publish'.

In this context, it seemed strange to require the edit_post privilege to publish a post.

[markoheijnen]

wp.* methods are leading to me. So I rather fix blogger_newPost and mw_newPost if needed.

[SergeyBiryukov]

Introduced in [16802].

[chriscct7]

Fixes both permission issues

[johnbillion]

24280.patch​ has the opposite of the intended affect. It allows someone with either the edit_posts or publish_posts cap to publish a post.

Replying to fgauthier:

In fact, I meant functions like blogger_newPost($args) and mw_newPost($args) that do not check the edit_post privilege when the status of the new post is set to 'publish'.

blogger_newPost() and mw_newPost() both check the edit_posts cap too. Those functions, along with mt_publishPost(), all look correct to me. In order to publish a post, you also need the ability to edit that post.

I think this ticket is invalid.

[chriscct7]

Replying to johnbillion:

24280.patch​ has the opposite of the intended affect. It allows someone with either the edit_posts or publish_posts cap to publish a post.

That's the intention. In the comments it is noted the publish_post cap doesn't exist at that point.

[johnbillion]

Discussed with Chris. Definitely invalid.

However, we could do with some tests here to prove this, so if someone wants to write tests which cover these methods then that would be super. We have existing tests for much of XML-RPC but not for these methods.

[chriscct7]

Replying to johnbillion:

Discussed with Chris. Definitely invalid.

However, we could do with some tests here to prove this, so if someone wants to write tests which cover these methods then that would be super. We have existing tests for much of XML-RPC but not for these methods.

Can we split that off into a new ticket?