WP_REST_Comments_Controller::check_target_post_permission │ protected │ WP 7.1.1

Checks that a post can receive a comment or a note from the current user.

Used when creating a note and when changing the parent post of an existing comment or note, so that attaching content to a post is authorized the same way whichever path it arrives by.

Method of the class: WP_REST_Comments_Controller{}

No Hooks.

Returns

true|WP_Error. True if the post can receive the comment, error object otherwise.

Usage

// protected - for code of main (parent) or child class
$result = $this->check_target_post_permission( $post_id, $request, $is_note );

$post_id(int) (required)

Target post ID.

$request(WP_REST_Request) (required)

Full details about the request.

$is_note(true|false)

Whether the comment is a note.
Default: false

Changelog

WP_REST_Comments_Controller::check_target_post_permission() WP REST Comments Controller::check target post permission code ^{WP 7.1.2}

protected function check_target_post_permission( int $post_id, WP_REST_Request $request, bool $is_note = false ) {
	if ( ! $post_id ) {
		return new WP_Error(
			'rest_comment_invalid_post_id',
			__( 'Sorry, you are not allowed to create this comment without a post.' ),
			array( 'status' => 403 )
		);
	}

	/*
	 * Notes are editorial content, so they may only be attached to a post the
	 * user can edit. Any other comment needs either comment moderation rights
	 * or edit access to the post, which is what check_edit_permission() grants
	 * on the post a comment is moving away from. Requiring the same at the
	 * destination means both ends of a move are authorized alike.
	 */
	if ( $is_note ) {
		$can_target_post = current_user_can( 'edit_post', $post_id );
	} else {
		$can_target_post = current_user_can( 'moderate_comments' ) || current_user_can( 'edit_post', $post_id );
	}

	if ( ! $can_target_post ) {
		if ( $is_note ) {
			return new WP_Error(
				'rest_cannot_create_note',
				__( 'Sorry, you are not allowed to create notes for this post.' ),
				array( 'status' => rest_authorization_required_code() )
			);
		}

		return new WP_Error(
			'rest_cannot_edit',
			__( 'Sorry, you are not allowed to edit this comment.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	$post = get_post( $post_id );

	if ( ! $post ) {
		return new WP_Error(
			'rest_comment_invalid_post_id',
			__( 'Sorry, you are not allowed to create this comment without a post.' ),
			array( 'status' => 403 )
		);
	}

	/*
	 * The remaining rules mirror the create-time checks for notes only. They are
	 * deliberately not applied to other comments, because moderators move comments
	 * onto posts whose discussion has closed and onto drafts today. Enforcing the
	 * create-time rules there would break that without blocking anything the
	 * capability check above already permits.
	 */
	if ( ! $is_note ) {
		return true;
	}

	if ( ! $this->check_post_type_supports_notes( $post->post_type ) ) {
		return new WP_Error(
			'rest_comment_not_supported_post_type',
			__( 'Sorry, this post type does not support notes.' ),
			array( 'status' => 403 )
		);
	}

	if ( 'trash' === $post->post_status ) {
		return new WP_Error(
			'rest_comment_trash_post',
			__( 'Sorry, you are not allowed to create a comment on this post.' ),
			array( 'status' => 403 )
		);
	}

	if ( ! $this->check_read_post_permission( $post, $request ) ) {
		return new WP_Error(
			'rest_cannot_read_post',
			__( 'Sorry, you are not allowed to read the post for this comment.' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	return true;
}