[wp-trac] [WordPress Trac] #42296: REST API: logical error while checking for already deleted post

[WordPress Trac]

#42296: REST API: logical error while checking for already deleted post
--------------------------+-----------------------------
 Reporter:  schlessera    |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  REST API      |    Version:  4.7.2
 Severity:  normal        |   Keywords:
  Focuses:  rest-api      |
--------------------------+-----------------------------
 In the `delete_item()` method of the  REST API posts controller, there's a
 piece of code that checks whether the post to be deleted has already been
 deleted before:

 {{{#!php
 <?php
 if ( 'trash' === $post->post_status ) {
     return new WP_Error( 'rest_already_trashed', __( 'The post has already
 been deleted.' ), array( 'status' => 410 ) );
 }
 }}}

 The problem with this code is that the post was fetched with the
 `get_post()` method that was introduced with
 [https://core.trac.wordpress.org/changeset/39954 Changeset 39954]. That
 method  already returns a `rest_post_invalid_id` if the `post_type` does
 not match the one that was used for constructing the controller. So the
 condition that is being checked for can never be true. It seems this was
 an unintentional breaking change in v4.7.2.

 I can see two valid options for making this work correctly (and return the
 correct error type):

 A. Avoid the use of the `get_post()` method in `delete_item()`, and fetch
 the post directly. This makes it possible to keep posts of type `trash` as
 valid results still.

 B. Change the `get_post()` method to also let posts of type `trash`
 through. This might mean that some of the controller method might need
 additional filtering.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/42296>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform