Skip to content
This repository was archived by the owner on Sep 24, 2018. It is now read-only.

Defer to edit_posts of the custom post type #1886

Merged
joehoyle merged 3 commits into from
Jan 4, 2016
Merged

Defer to edit_posts of the custom post type #1886

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6d0704f
Defer to `edit_posts` of the custom post type
danielbachhuber Dec 21, 2015
35e9f81
Add tests for ensuring private query vars are available
danielbachhuber Dec 23, 2015
3100ee7
Explicitly assert expected result set
danielbachhuber Dec 23, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion lib/endpoints/class-wp-rest-posts-controller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -558,7 +558,8 @@ protected function get_allowed_query_vars() {
*/
$valid_vars = apply_filters( 'query_vars', $wp->public_query_vars );

if ( current_user_can( 'edit_posts' ) ) {
$post_type_obj = get_post_type_object( $this->post_type );
if ( current_user_can( $post_type_obj->cap->edit_posts ) ) {
/**
* Filter the allowed 'private' query vars for authorized users.
*
Expand Down
19 changes: 19 additions & 0 deletions tests/test-rest-pages-controller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,25 @@ public function test_get_items() {

}

public function test_get_items_private_filter_query_var() {
// Private query vars inaccessible to unauthorized users
wp_set_current_user( 0 );

@danielbachhuber danielbachhuber Dec 23, 2015

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wanted to test contributors here too, as they don't have the ability to edit pages, but I ran into #1892

$page_id = $this->factory->post->create( array( 'post_status' => 'publish', 'post_type' => 'page' ) );
$draft_id = $this->factory->post->create( array( 'post_status' => 'draft', 'post_type' => 'page' ) );
$request = new WP_REST_Request( 'GET', '/wp/v2/pages' );
$request->set_param( 'filter', array( 'post_status' => 'draft' ) );
$response = $this->server->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 1, $data );
$this->assertEquals( $page_id, $data[0]['id'] );
// But they are accessible to authorized users
wp_set_current_user( $this->editor_id );
$response = $this->server->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 1, $data );
$this->assertEquals( $draft_id, $data[0]['id'] );
}

public function test_get_item() {

}
Expand Down
18 changes: 18 additions & 0 deletions tests/test-rest-posts-controller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,24 @@ public function test_get_items_pagination_headers() {
$this->assertContains( '<' . $next_link . '>; rel="next"', $headers['Link'] );
}

public function test_get_items_private_filter_query_var() {
// Private query vars inaccessible to unauthorized users
wp_set_current_user( 0 );
$draft_id = $this->factory->post->create( array( 'post_status' => 'draft' ) );
$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
$request->set_param( 'filter', array( 'post_status' => 'draft' ) );
$response = $this->server->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 1, $data );
$this->assertEquals( $this->post_id, $data[0]['id'] );
// But they are accessible to authorized users
wp_set_current_user( $this->editor_id );
$response = $this->server->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 1, $data );
$this->assertEquals( $draft_id, $data[0]['id'] );
}

public function test_get_item() {
$request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', $this->post_id ) );
$response = $this->server->dispatch( $request );
Expand Down