[wp-trac] [WordPress Trac] #38816: REST API: logic error in comments post ID

[WordPress Trac]

#38816: REST API: logic error in comments post ID
--------------------------+-----------------------
 Reporter:  dd32          |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  4.7
Component:  Comments      |    Version:
 Severity:  normal        |   Keywords:  has-patch
  Focuses:  rest-api      |
--------------------------+-----------------------
 The rest API currently requires that a comment from a non-privileged user
 be added to a post which the user can read (ie. not trashed, private,
 draft, etc).

 However the checks miss a case where the user attempts to add a comment
 for a future post which does not yet exist (ie. max_post_id + 1). This
 should be prevented, to prevent a comment being added to a not-yet-created
 post (which would then inherit it).

 I'm not sure I understand the logic behind allowing comment creation for a
 non-existent post_id if the user has `moderate_comments` cap though.. that
 doesn't appear to be something which we would need to support.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/38816>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform