Changeset 61936

Timestamp:

03/11/2026 01:34:01 PM (2 days ago)

Author:

johnbillion

Message:

Comments: Don't attempt to create a note if the user cannot edit the target post.

Merges [61888] into the 6.9 branch.

Props johnbillion, peterwilsoncc, adamsilverstein.

Location:

branches/6.9

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)

branches/6.9/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -559 +559 @@
                 );
             }
+        }
+
+        if ( $is_note && ! empty( $request['post'] ) && ! current_user_can( 'edit_post', (int) $request['post'] ) ) {
+            return new WP_Error(
+                'rest_cannot_create_note',
+                __( 'Sorry, you are not allowed to create notes for this post.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
         }