Skip to content
This repository was archived by the owner on Sep 24, 2018. It is now read-only.

Validate GET /wp/v2/comments private query params #2178

Merged
danielbachhuber merged 6 commits into from
Jan 30, 2016
Merged

Validate GET /wp/v2/comments private query params #2178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c247be8
Validate `GET /wp/v2/comments` private query params
danielbachhuber Jan 30, 2016
72613c5
Merge branch 'develop' into 1212-error-private-query-var
danielbachhuber Jan 30, 2016
22e27d7
Fix logical error for sniffing out invalid param
danielbachhuber Jan 30, 2016
c99d70a
Fix spacing
danielbachhuber Jan 30, 2016
e90e390
Fix typo
danielbachhuber Jan 30, 2016
0a5544a
Mention these params require authorization
danielbachhuber Jan 30, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 36 additions & 24 deletions lib/endpoints/class-wp-rest-comments-controller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,27 @@ public function get_items_permissions_check( $request ) {
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view comments with edit context.' ), array( 'status' => rest_authorization_required_code() ) );
}

if ( ! current_user_can( 'edit_posts' ) ) {
$protected_params = array( 'author', 'karma', 'author_email', 'type', 'status' );
$forbidden_params = array();
foreach ( $protected_params as $param ) {
if ( 'status' === $param ) {
if ( 'approve' !== $request[ $param ] ) {
$forbidden_params[] = $param;
}
} else if ( 'type' === $param ) {
if ( 'comment' !== $request[ $param ] ) {
$forbidden_params[] = $param;
}
} else if ( ! empty( $request[ $param ] ) ) {
$forbidden_params[] = $param;
}
}
if ( ! empty( $forbidden_params ) ) {
return new WP_Error( 'rest_forbidden_param', sprintf( __( 'Query parameter not permitted: %s' ), implode( ', ', $forbidden_params ) ), array( 'status' => rest_authorization_required_code() ) );
}
}

return true;
}

Expand All @@ -95,36 +116,27 @@ public function get_items_permissions_check( $request ) {
*/
public function get_items( $request ) {
$prepared_args = array(
'author_email' => isset( $request['author_email'] ) ? $request['author_email'] : '',
'comment__in' => $request['include'],
'comment__not_in' => $request['exclude'],
'karma' => isset( $request['karma'] ) ? $request['karma'] : '',
'number' => $request['per_page'],
'post_id' => $request['post'] ? $request['post'] : '',
'parent' => isset( $request['parent'] ) ? $request['parent'] : '',
'search' => $request['search'],
'offset' => $request['offset'],
'orderby' => $this->normalize_query_param( $request['orderby'] ),
'order' => $request['order'],
'status' => 'approve',
'type' => 'comment',
'status' => $request['status'],
'type' => $request['type'],
'no_found_rows' => false,
'user_id' => $request['author'] ? $request['author'] : '',
);

if ( empty( $request['offset'] ) ) {
$prepared_args['offset'] = $prepared_args['number'] * ( absint( $request['page'] ) - 1 );
}

if ( current_user_can( 'edit_posts' ) ) {
$protected_args = array(
'user_id' => $request['author'] ? $request['author'] : '',
'status' => $request['status'],
'type' => isset( $request['type'] ) ? $request['type'] : '',
'author_email' => isset( $request['author_email'] ) ? $request['author_email'] : '',
'karma' => isset( $request['karma'] ) ? $request['karma'] : '',
);

$prepared_args = array_merge( $prepared_args, $protected_args );
}

/**
* Filter arguments, before passing to WP_Comment_Query, when querying comments via the REST API.
*
Expand Down Expand Up @@ -903,9 +915,15 @@ public function get_collection_params() {

$query_params['context']['default'] = 'view';

$query_params['author'] = array(
'description' => __( 'Limit result set to comments assigned to a specific user id. Requires authorization.' ),
'sanitize_callback' => 'absint',
'type' => 'integer',
'validate_callback' => 'rest_validate_request_arg',
);
$query_params['author_email'] = array(
'default' => null,
'description' => __( 'Limit result set to that from a specific author email.' ),
'description' => __( 'Limit result set to that from a specific author email. Requires authorization.' ),
'format' => 'email',
'sanitize_callback' => 'sanitize_email',
'validate_callback' => 'rest_validate_request_arg',
Expand All @@ -927,7 +945,7 @@ public function get_collection_params() {
);
$query_params['karma'] = array(
'default' => null,
'description' => __( 'Limit result set to that of a particular comment karma.' ),
'description' => __( 'Limit result set to that of a particular comment karma. Requires authorization.' ),
'sanitize_callback' => 'absint',
'type' => 'integer',
'validate_callback' => 'rest_validate_request_arg',
Expand Down Expand Up @@ -981,24 +999,18 @@ public function get_collection_params() {
);
$query_params['status'] = array(
'default' => 'approve',
'description' => __( 'Limit result set to comments assigned a specific status.' ),
'description' => __( 'Limit result set to comments assigned a specific status. Requires authorization.' ),
'sanitize_callback' => 'sanitize_key',
'type' => 'string',
'validate_callback' => 'rest_validate_request_arg',
);
$query_params['type'] = array(
'default' => 'comment',
'description' => __( 'Limit result set to comments assigned a specific type.' ),
'description' => __( 'Limit result set to comments assigned a specific type. Requires authorization.' ),
'sanitize_callback' => 'sanitize_key',
'type' => 'string',
'validate_callback' => 'rest_validate_request_arg',
);
$query_params['author'] = array(
'description' => __( 'Limit result set to comments assigned to a specific user id.' ),
'sanitize_callback' => 'absint',
'type' => 'integer',
'validate_callback' => 'rest_validate_request_arg',
);
return $query_params;
}

Expand Down
7 changes: 3 additions & 4 deletions tests/test-rest-comments-controller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,6 +223,7 @@ public function test_get_items_private_post_no_permissions() {
}

public function test_get_items_author_arg() {
// Authorized
wp_set_current_user( $this->admin_id );
$args = array(
'comment_approved' => 1,
Expand All @@ -241,12 +242,10 @@ public function test_get_items_author_arg() {
$this->assertEquals( 200, $response->get_status() );
$comments = $response->get_data();
$this->assertCount( 2, $comments );
// Unavailable to unauthenticated; defauls to all authenticated
// Unavailable to unauthenticated; defaults to error
wp_set_current_user( 0 );
$response = $this->server->dispatch( $request );
$this->assertEquals( 200, $response->get_status() );
$comments = $response->get_data();
$this->assertCount( 4, $comments );
$this->assertErrorResponse( 'rest_forbidden_param', $response, 401 );
}

public function test_get_comments_pagination_headers() {
Expand Down