REST API: Return 404 for invalid post ID in Comments update_item(). by dhrupo · Pull Request #12545 · WordPress/wordpress-develop

dhrupo · 2026-07-15T17:54:26Z

Summary

WP_REST_Comments_Controller::update_item() returned HTTP 403 (Forbidden) when the request targeted a non-existent post ID (e.g. PUT /wp/v2/comments/<id> with post set to a missing post). The correct status is 404 (Not Found): the post is a missing resource, not an authorization failure.

This also makes update_item() consistent with get_item(), which already returns 404 for the same "post does not exist" scenario within the same controller.

Changes

class-wp-rest-comments-controller.php: change the rest_comment_invalid_post_id error status from 403 to 404 in update_item().
rest-comments-controller.php (tests): update the test_update_comment_invalid_post_id assertion to expect 404.

The error code (rest_comment_invalid_post_id) is intentionally unchanged to preserve backwards compatibility for clients matching on it. The create_item 403 responses ("Sorry, you are not allowed to create this comment without a post.") are genuine authorization checks and are left untouched.

Relationship to #11529

This completes the work started in #11529 by @saratheonline, which made the code change but left the existing unit test asserting 403, causing CI to fail. @westonruter requested changes noting the test needed updating. This PR includes both the code fix and the corresponding test update so the suite passes.

Testing

Reproduced red → green:

With the unpatched code, updating test_update_comment_invalid_post_id to expect 404 fails: Failed asserting that 403 is identical to 404.
After the one-line controller fix, the test passes.

Full controller suite green (verified in the local Docker environment):

WP_Test_REST_Comments_Controller: OK (142 tests, 675 assertions)

Manual reproduction:

curl -X POST http://localhost:8889/wp-json/wp/v2/comments/1 \
  -u "admin:<app-password>" \
  -H "Content-Type: application/json" \
  -d '{"post": 9999}'
# Before: 403 Forbidden
# After:  404 Not Found

Trac ticket: https://core.trac.wordpress.org/ticket/65050

Props saratheonline.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 4.8
Used for: Reproducing the failing test, applying the fix and the test update, and running the test suite. All changes were reviewed by me.

`WP_REST_Comments_Controller::update_item()` returned HTTP 403 (Forbidden) when the request targeted a non-existent post ID. The correct status is 404 (Not Found): the post is a missing resource, not an authorization failure. This also makes `update_item()` consistent with `get_item()`, which already returns 404 for the same scenario. Also updates the `test_update_comment_invalid_post_id` assertion to expect the corrected 404 status. Props saratheonline. See #65050.

github-actions · 2026-07-15T17:54:39Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props dhrupo, wildworks, mirmpro.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-07-15T18:00:23Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Copilot

Pull request overview

This pull request corrects REST API error semantics in WP_REST_Comments_Controller::update_item() by returning 404 Not Found (instead of 403 Forbidden) when an update request references a non-existent post ID, aligning the response with “missing resource” behavior and with existing 404 patterns in the same controller.

Changes:

Update update_item() to return WP_Error( 'rest_comment_invalid_post_id', ... ) with status => 404 when the provided post ID does not exist.
Update the corresponding PHPUnit test to expect a 404 response for this scenario.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
`src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php`	Changes invalid post ID status in `update_item()` from 403 to 404 to reflect a missing resource.
`tests/phpunit/tests/rest-api/rest-comments-controller.php`	Updates `test_update_comment_invalid_post_id()` to assert 404 for the updated behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

mirmpro · 2026-07-30T15:58:25Z

Test Report
Patch tested: #12545

Environment

WordPress: 7.1-beta3-20260728.073044
Subdirectory: No
PHP: 7.4.33 (cli)
Server: PHP.wasm (Emscripten 4.0.19 wasm32)
Database: WP_MySQL_On_SQLite (Server: 8.0.38 / Client: 3.51.0)
Browser: Chrome 150.0.0.0
OS: macOS
Theme: Twenty Twenty-Five 1.5
MU Plugins: None activated
Plugins: None activated

Steps taken

Launched the WordPress testing environment via the Playground PR preview URL for PR REST API: Return 404 for invalid post ID in Comments update_item(). #12545.
Opened the browser developer console while logged in as Administrator.

Executed a REST API request targeting an existing comment (/wp/v2/comments/1) and attempted to update its associated post to a non-existent post ID (99999):

wp.apiFetch({
  path: '/wp/v2/comments/1',
  method: 'POST',
  data: { post: 99999 }
}).catch( error => console.log('Response Status:', error.data.status, error) );

Verified that the API response returns Response Status: 404 with error code rest_comment_invalid_post_id (message: 'Invalid post ID.'), whereas previously it incorrectly returned status 403 (Forbidden).

✅ Patch is solving the problem

Expected result

Updating a comment with a non-existent post ID should return HTTP status 404 (Not Found) instead of 403 (Forbidden).

Additional Notes

Verified PR #12545 for Trac #65050. Returning 404 for missing post resources brings consistency between update_item() and get_item().

Support Content

Website Playground URL with parameters used for testing:
https://playground.wordpress.net/?core-pr=12545#%7B%22$schema%22:%22https://playground.wordpress.net/blueprint-schema.json%22,%22landingPage%22:%22/wp-admin%22,%22login%22:true,%22preferredVersions%22:%7B%22php%22:%227.4%22%7D,%22features%22:%7B%22networking%22:true%7D%7D

Merge branch 'trunk' into ticket-65050-rest-comments-invalid-post-id-404

3264acd

Merge branch 'trunk' into ticket-65050-rest-comments-invalid-post-id-404

c40b1ce

Copilot AI review requested due to automatic review settings July 28, 2026 07:29

Copilot started reviewing on behalf of t-hamano July 28, 2026 07:29

View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

Navigation Menu

Repository navigation

REST API: Return 404 for invalid post ID in Comments update_item(). - #12545

REST API: Return 404 for invalid post ID in Comments update_item().#12545
dhrupo wants to merge 3 commits into
WordPress:trunkfrom
dhrupo:ticket-65050-rest-comments-invalid-post-id-404

dhrupo commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mirmpro commented Jul 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

dhrupo commented Jul 15, 2026

Summary

Changes

Relationship to #11529

Testing

Use of AI Tools

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

mirmpro commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Jul 15, 2026 •

edited

Loading

mirmpro commented Jul 30, 2026 •

edited

Loading