WordPress.org

Make WordPress Core

Opened 10 months ago

Closed 10 months ago

Last modified 10 months ago

#39012 closed defect (bug) (fixed)

REST API: Capability check for editing a single term should use the singular form

Reported by: johnbillion Owned by: pento
Milestone: 4.7 Priority: normal
Severity: normal Version: 4.7
Component: Taxonomy Keywords: has-patch commit dev-reviewed
Focuses: rest-api Cc:

Description

The capability check used in WP_REST_Terms_Controller::get_item_permissions_check() is edit_terms, but it should be edit_term with the associated term ID.

The docblock description also needs correcting.

Attachments (2)

39012.diff (1.2 KB) - added by johnbillion 10 months ago.
39012.2.diff (1.6 KB) - added by nacin 10 months ago.

Download all attachments as: .zip

Change History (8)

@johnbillion
10 months ago

#1 @johnbillion
10 months ago

  • Keywords has-patch needs-testing added; needs-patch removed

#2 @pento
10 months ago

  • Keywords commit dev-feedback added; needs-testing removed

Looks good.

I don't think it needs unit tests, short of adding tests for all combinations of singular/plural capabilities.

#3 @nacin
10 months ago

  • Keywords dev-reviewed added; dev-feedback removed

#4 @nacin
10 months ago

@dd32 @pento and I are discussing both this and #35614 -- and the map_meta_cap() really needs an (int) here because there's always been weird gremlins in the terms API about numeric strings being thought about as slugs.

$request['id'] is also cast to an int everywhere else in this file. I suggest we put it in both places.

@nacin
10 months ago

#5 @pento
10 months ago

  • Owner set to pento
  • Resolution set to fixed
  • Status changed from new to closed

In 39464:

REST API: Capability check for editing a single term should use the singular form.

As an extra level of sanity checking, the term ID should be cast as an int in map_meta_cap().

Props johnbillion, nacin, dd32, pento.
See #35614.
Fixes #39012.

#6 @pento
10 months ago

In 39465:

REST API: Capability check for editing a single term should use the singular form.

As an extra level of sanity checking, the term ID should be cast as an int in map_meta_cap().

Merge of [39464] to the 4.7 branch.

Props johnbillion, nacin, dd32, pento.
See #35614.
Fixes #39012.

Note: See TracTickets for help on using tickets.