From 910628e2ae1d35855f4d1be9df9862036e59bec5 Mon Sep 17 00:00:00 2001 From: rvpatel Date: Thu, 29 Oct 2026 23:59:35 +0530 Subject: [PATCH] Tests: Cover note edit and delete permissions for comment moderators. [64875] requires edit access to a note's post to update or delete the note, instead of the `moderate_comments` capability, but no test covered it. Add tests that a user who can moderate comments but cannot edit the post gets a 403 when updating or deleting a note, and that the note is unchanged. Both tests fail without the fix. Follow-up to [64875]. See #65819. --- .../rest-api/rest-comments-controller.php | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/tests/phpunit/tests/rest-api/rest-comments-controller.php b/tests/phpunit/tests/rest-api/rest-comments-controller.php index 70fe2b2a71131..07de57edbf050 100644 --- a/tests/phpunit/tests/rest-api/rest-comments-controller.php +++ b/tests/phpunit/tests/rest-api/rest-comments-controller.php @@ -5567,6 +5567,67 @@ public function test_update_note_is_still_allowed() { $this->assertSame( 200, $response->get_status() ); } + /** + * Creates a note on a post the given moderator cannot edit. + * + * @return array{0: int, 1: int} The note ID and the ID of a user who can moderate + * comments but cannot edit the note's post. + */ + private function create_note_and_moderator_without_edit_access() { + $post_id = self::factory()->post->create( array( 'post_author' => self::$editor_id ) ); + $note_id = self::factory()->comment->create( + array( + 'comment_post_ID' => $post_id, + 'comment_type' => 'note', + 'comment_approved' => 0, + 'user_id' => self::$editor_id, + 'comment_content' => 'Test note', + ) + ); + + $moderator = self::factory()->user->create_and_get( array( 'role' => 'subscriber' ) ); + $moderator->add_cap( 'moderate_comments' ); + + $this->assertFalse( user_can( $moderator, 'edit_post', $post_id ), 'The moderator should not be able to edit the post.' ); + + return array( $note_id, $moderator->ID ); + } + + /** + * A user who can moderate comments but cannot edit the note's post cannot update the note. + * + * @ticket 65819 + */ + public function test_moderator_without_edit_access_cannot_update_note() { + list( $note_id, $moderator_id ) = $this->create_note_and_moderator_without_edit_access(); + + wp_set_current_user( $moderator_id ); + $request = new WP_REST_Request( 'PUT', '/wp/v2/comments/' . $note_id ); + $request->add_header( 'Content-Type', 'application/json' ); + $request->set_body( wp_json_encode( array( 'content' => 'Edited note' ) ) ); + $response = rest_get_server()->dispatch( $request ); + + $this->assertErrorResponse( 'rest_cannot_edit', $response, 403 ); + $this->assertSame( 'Test note', get_comment( $note_id )->comment_content ); + } + + /** + * A user who can moderate comments but cannot edit the note's post cannot delete the note. + * + * @ticket 65819 + */ + public function test_moderator_without_edit_access_cannot_delete_note() { + list( $note_id, $moderator_id ) = $this->create_note_and_moderator_without_edit_access(); + + wp_set_current_user( $moderator_id ); + $request = new WP_REST_Request( 'DELETE', '/wp/v2/comments/' . $note_id ); + $request->set_param( 'force', true ); + $response = rest_get_server()->dispatch( $request ); + + $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 ); + $this->assertInstanceOf( WP_Comment::class, get_comment( $note_id ) ); + } + /** * The note response exposes a `reaction_summary` field aggregating * counts per emoji hex key, plus the current user's reaction ID as