gutenberg / lib / experimental / class-gutenberg-rest-comment-controller.php

class-gutenberg-rest-comment-controller.php in Gutenberg 21.7.0, at lib/experimental/class-gutenberg-rest-comment-controller.php

124 lines 3.9 KB

Raw Download Zip

1	<?php
2	/**
3	* A custom REST server for Gutenberg.
4	*
5	* @package gutenberg
6	* @since 6.8.0
7	*/
8
9	// Create a new class that extends WP_REST_Comments_Controller
10	class Gutenberg_REST_Comment_Controller extends WP_REST_Comments_Controller {
11
12	public function create_item_permissions_check( $request ) {
13	if ( empty( $request['comment_type'] ) \|\| 'comment' === $request['comment_type'] ) {
14	return parent::create_item_permissions_check( $request );
15	}
16
17	if ( ! is_user_logged_in() ) {
18	if ( get_option( 'comment_registration' ) ) {
19	return new WP_Error(
20	'rest_comment_login_required',
21	__( 'Sorry, you must be logged in to comment.', 'gutenberg' ),
22	array( 'status' => 401 )
23	);
24	}
25
26	/**
27	* Filters whether comments can be created via the REST API without authentication.
28	*
29	* Enables creating comments for anonymous users.
30	*
31	* @since 4.7.0
32	*
33	* @param bool $allow_anonymous Whether to allow anonymous comments to
34	* be created. Default `false`.
35	* @param WP_REST_Request $request Request used to generate the
36	* response.
37	*/
38	$allow_anonymous = apply_filters( 'rest_allow_anonymous_comments', false, $request );
39
40	if ( ! $allow_anonymous ) {
41	return new WP_Error(
42	'rest_comment_login_required',
43	__( 'Sorry, you must be logged in to comment.', 'gutenberg' ),
44	array( 'status' => 401 )
45	);
46	}
47	}
48
49	// Limit who can set comment `author`, `author_ip` or `status` to anything other than the default.
50	if ( isset( $request['author'] ) && get_current_user_id() !== $request['author'] && ! current_user_can( 'moderate_comments' ) ) {
51	return new WP_Error(
52	'rest_comment_invalid_author',
53	/* translators: %s: Request parameter. */
54	sprintf( __( "Sorry, you are not allowed to edit '%s' for comments.", 'gutenberg' ), 'author' ),
55	array( 'status' => rest_authorization_required_code() )
56	);
57	}
58
59	if ( isset( $request['author_ip'] ) && ! current_user_can( 'moderate_comments' ) ) {
60	if ( empty( $_SERVER['REMOTE_ADDR'] ) \|\| $request['author_ip'] !== $_SERVER['REMOTE_ADDR'] ) {
61	return new WP_Error(
62	'rest_comment_invalid_author_ip',
63	/* translators: %s: Request parameter. */
64	sprintf( __( "Sorry, you are not allowed to edit '%s' for comments.", 'gutenberg' ), 'author_ip' ),
65	array( 'status' => rest_authorization_required_code() )
66	);
67	}
68	}
69
70	if ( isset( $request['status'] ) && ! current_user_can( 'moderate_comments' ) ) {
71	return new WP_Error(
72	'rest_comment_invalid_status',
73	/* translators: %s: Request parameter. */
74	sprintf( __( "Sorry, you are not allowed to edit '%s' for comments.", 'gutenberg' ), 'status' ),
75	array( 'status' => rest_authorization_required_code() )
76	);
77	}
78
79	if ( empty( $request['post'] ) ) {
80	return new WP_Error(
81	'rest_comment_invalid_post_id',
82	__( 'Sorry, you are not allowed to create this comment without a post.', 'gutenberg' ),
83	array( 'status' => 403 )
84	);
85	}
86
87	$post = get_post( (int) $request['post'] );
88
89	if ( ! $post ) {
90	return new WP_Error(
91	'rest_comment_invalid_post_id',
92	__( 'Sorry, you are not allowed to create this comment without a post.', 'gutenberg' ),
93	array( 'status' => 403 )
94	);
95	}
96
97	if ( 'trash' === $post->post_status ) {
98	return new WP_Error(
99	'rest_comment_trash_post',
100	__( 'Sorry, you are not allowed to create a comment on this post.', 'gutenberg' ),
101	array( 'status' => 403 )
102	);
103	}
104
105	if ( ! $this->check_read_post_permission( $post, $request ) ) {
106	return new WP_Error(
107	'rest_cannot_read_post',
108	__( 'Sorry, you are not allowed to read the post for this comment.', 'gutenberg' ),
109	array( 'status' => rest_authorization_required_code() )
110	);
111	}
112
113	return true;
114	}
115	}
116
117	add_action(
118	'rest_api_init',
119	function () {
120	$controller = new Gutenberg_REST_Comment_Controller();
121	$controller->register_routes();
122	}
123	);
124