@@ -4226,50 +4226,24 @@ public function test_get_items_type_arg_unauthenticated( $comment_type, $count )
42264226 $ request ->set_param ( 'per_page ' , self ::$ per_page );
42274227
42284228 $ response = rest_get_server ()->dispatch ( $ request );
4229- $ this ->assertEquals ( 'note ' !== $ comment_type ? 200 : 401 , $ response ->get_status () );
4230- if ( 'note ' === $ comment_type ) {
4229+
4230+ // Only comments can be retrieved from the /comments (multiple) endpoint when unauthenticated.
4231+ $ this ->assertEquals ( 'comment ' === $ comment_type ? 200 : 401 , $ response ->get_status () );
4232+ if ( 'comment ' !== $ comment_type ) {
42314233 $ this ->assertErrorResponse ( 'rest_forbidden_param ' , $ response , 401 );
42324234 }
42334235
4234- // Next, test getting the individual comments.
4236+ // Individual comments.
42354237 foreach ( $ comments as $ comment ) {
42364238 $ request = new WP_REST_Request ( 'GET ' , sprintf ( '/wp/v2/comments/%d ' , $ comment ) );
42374239 $ response = rest_get_server ()->dispatch ( $ request );
4238- $ this ->assertEquals ( 'note ' !== $ comment_type ? 200 : 401 , $ response ->get_status () );
4240+
4241+ // Individual comments using the /comments/<id> endpoint can (unexpectedly) be
4242+ // retrieved by unauthenticated users - except for the 'note' type which is restricted.
4243+ // See https://core.trac.wordpress.org/ticket/44157.
4244+ $ this ->assertEquals ( 'note ' === $ comment_type ? 401 : 200 , $ response ->get_status () );
42394245 }
42404246 }
42414247
4242- /**
4243- * Test retrieving individual comments by type as unauthenticated user.
4244- *
4245- * @dataProvider data_comment_type_provider
4246- * @ticket 44157
4247- *
4248- * @param string $comment_type The comment type to test.
4249- * @param int $count The number of comments to create (only 1 used).
4250- */
4251- public function test_get_individual_comment_type_unauthenticated ( $ comment_type , $ count ) {
4252- // Create a single comment as admin.
4253- wp_set_current_user ( self ::$ admin_id );
4254-
4255- $ args = array (
4256- 'comment_approved ' => 1 ,
4257- 'comment_post_ID ' => self ::$ post_id ,
4258- 'user_id ' => self ::$ author_id ,
4259- 'comment_type ' => $ comment_type ,
4260- );
4261-
4262- $ comment_id = self ::factory ()->comment ->create ( $ args );
42634248
4264- // Log out and test as unauthenticated user.
4265- wp_logout ();
4266-
4267- $ request = new WP_REST_Request ( 'GET ' , sprintf ( '/wp/v2/comments/%d ' , $ comment_id ) );
4268- $ response = rest_get_server ()->dispatch ( $ request );
4269-
4270- $ this ->assertEquals ( 'comment ' === $ comment_type ? 200 : 401 , $ response ->get_status () );
4271- if ( 'comment ' !== $ comment_type ) {
4272- $ this ->assertErrorResponse ( 'rest_cannot_read ' , $ response , 401 );
4273- }
4274- }
42754249}
0 commit comments