Comment REST API route: add support for filtering by multiple statuses. by adamsilverstein · Pull Request #9870 · WordPress/wordpress-develop

adamsilverstein · 2025-09-14T19:59:35Z

Add support for filtering the comments collection endpoint by multiple statuses, eg. /wp/v2/comments?status=approve,hold or status[]=approve&status[]=hold. WP_Comment_Query already accepts an array of statuses, so this brings the REST endpoint in line with what the underlying query supports. Single string values continue to work as before.

Originally extracted from the Notes work, see WordPress/gutenberg#71271 (WordPress/gutenberg#71271 (comment))

Changes:

Define the status collection param as an array of strings, each sanitized with sanitize_key, following the pattern of the posts controller.
Update the status check in get_items_permissions_check to handle array values. Behavior is unchanged: unauthenticated requests can only use the default approve status, anything else requires edit_posts.
Add tests covering single, multiple, comma separated and all status queries, sanitization of the param, and the authorization boundary.
Regenerate the QUnit REST schema fixture.

Note: I did not add an enum of allowed values here - WP_Comment_Query explicitly supports custom comment statuses and the endpoint currently accepts any string (eg. spam and trash work today for authorized users), so an enum limited to the registered statuses would be a back compat break.

Testing instructions

On a test site, create some comments and mark a few as approved and a few as pending (the Comments screen works for this).
As an authorized user (I used an application password), request multiple statuses and verify comments from both lists are returned:
curl --user admin:APP_PASSWORD "https://example.test/wp-json/wp/v2/comments?status=approve,hold"
Request a single status, eg. ?status=hold, and verify only pending comments are returned.
Without authentication, verify ?status=approve still returns approved comments and ?status=approve,hold returns a rest_forbidden_param error.
Run the unit tests: npm run test:php -- --filter WP_Test_REST_Comments_Controller

Trac ticket: https://core.trac.wordpress.org/ticket/63982

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

github-actions · 2025-09-14T20:28:03Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

The Plugin and Theme Directories cannot be accessed within Playground.
All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

github-actions · 2025-09-15T05:19:02Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props adamsilverstein, westonruter, swissspidy, timothyblynjacobs, mukesh27, wildworks.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

t-hamano · 2025-09-15T12:35:57Z

We might not need to extend the REST API itself. See WordPress/gutenberg#71271 (comment)

Co-authored-by: Pascal Birchler <pascal.birchler@gmail.com>

adamsilverstein · 2025-09-15T14:44:52Z

We might not need to extend the REST API itself. See WordPress/gutenberg#71271 (comment)

Good point; that said its probably worth adding as its a simple change and reflects what the underlying core comments class already supports (so it feels like a bug or oversight that it isn't supported already). While we don't need it yet, I could easily see us or a plugin wanting this.

…roller.php Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>

Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>

With the status collection param now an array, the sanitized value never string-matches 'approve', so unauthenticated requests using the default status were rejected. Compare against the parsed list instead, define the schema as an array of strings per review feedback, and regenerate the QUnit fixture to match.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

westonruter

Good to add this test: #9870 (comment)

Otherwise, pre-approving.

The unauthenticated 401 boundary was only covered for the array form of the status parameter. Since the permission check now relies on the sanitize callback having parsed the raw value, the comma-separated form needs its own case so it cannot regress independently. Convert the test to a data provider covering both forms.

array_filter() without a callback drops all falsy strings, including '0'. WP_Comment_Query treats a literal '0' status as a direct comment_approved match (how held comments are stored), so ?status=0 is a working query today and must survive sanitization. Filter only empty strings instead.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Resolve the conflict in the comments controller, where trunk added check_target_post_permission() at the same spot the branch added sanitize_comment_statuses(). Both methods are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GqepyjmFSryBt88j6f6ubY

Trunk is now 7.2-alpha, so the new method ships in 7.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GqepyjmFSryBt88j6f6ubY

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DxbbMKz3sa741SjHuE1ZLS

t-hamano · 2026-10-03T13:47:53Z

@adamsilverstein, this PR looks good to merge, but do you have any concerns?

The `status` collection param is now typed as an array, but its default was still the string 'approve'. The permission checks compare against `array( 'approve' )`, so they only matched because sanitization coerced the default; declaring it as an array keeps the schema consistent with the param type and removes that implicit dependency. The generated QUnit schema fixture is updated to match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B6M4x5WcvJVMgMqxH6qBKv

adamsilverstein · 2026-10-03T20:03:12Z

@adamsilverstein, this PR looks good to merge, but do you have any concerns?

I think its ready, sweeping for unaddressed feedback.

adamsilverstein · 2026-10-04T00:39:17Z

@adamsilverstein , this PR looks good to merge, but do you have any concerns?

Looks good to me!

t-hamano

Looks good from my end. It might be worth noting the definition change under miscellaneous dev notes.

adamsilverstein added 4 commits September 14, 2025 12:58

Comments REST endpoint - support for multiple status values

82c76fa

Add tests for getting comments by status, statuses or ‘all’

1fc983f

spacing fixes for linter

4ee6fe8

Use count

bdd5a6d

Complete tests for status field

b878d8b

adamsilverstein changed the title ~~Add/comment rest api types support~~ Comment REST API route: add support for status as array Sep 15, 2025

adamsilverstein marked this pull request as ready for review September 15, 2025 05:18

adamsilverstein mentioned this pull request Sep 15, 2025

Block comments: Add comment indicators in the block toolbar WordPress/gutenberg#71271

Merged

adamsilverstein changed the title ~~Comment REST API route: add support for status as array~~ Comment REST API route: add support multiple statuses Sep 15, 2025

update wp-api-generated

f435d93

swissspidy reviewed Sep 15, 2025

View reviewed changes

Comment thread tests/phpunit/tests/rest-api/rest-comments-controller.php Outdated

Update tests/phpunit/tests/rest-api/rest-comments-controller.php

7b22c39

Co-authored-by: Pascal Birchler <pascal.birchler@gmail.com>

hello yoda my old friend

6225ae6

TimothyBJacobs reviewed Sep 15, 2025

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php Outdated

TimothyBJacobs reviewed Sep 15, 2025

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php Outdated

adamsilverstein added 3 commits September 15, 2025 15:26

API handles strings automatically when array type given

f121b3e

Handle multiple status sanitization

5fba5f6

Add additional tests

1ee7a86

mukeshpanchal27 reviewed Sep 16, 2025

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php Outdated

Update src/wp-includes/rest-api/endpoints/class-wp-rest-comments-cont…

3bf3121

…roller.php Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>

mukeshpanchal27 reviewed Sep 18, 2025

View reviewed changes

Comment thread tests/phpunit/tests/rest-api/rest-comments-controller.php Outdated

Update tests/phpunit/tests/rest-api/rest-comments-controller.php

f210ce5

Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>

adamsilverstein changed the title ~~Comment REST API route: add support multiple statuses~~ [WIP] Comment REST API route: add support multiple statuses Sep 18, 2025

pento force-pushed the trunk branch from 3af2d27 to 64ede28 Compare July 6, 2026 03:10

adamsilverstein added 2 commits July 23, 2026 09:06

Merge trunk into add/comment-rest-api-types-support

faca069

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

adamsilverstein requested review from dmsnell, joedolson, t-hamano and westonruter and removed request for dmsnell, joedolson, t-hamano and westonruter July 23, 2026 20:56

westonruter approved these changes Jul 23, 2026

View reviewed changes

westonruter reviewed Jul 23, 2026

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

Copilot AI review requested due to automatic review settings July 23, 2026 22:52

Copilot started reviewing on behalf of adamsilverstein July 23, 2026 22:55 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 23, 2026 22:59

Copilot started reviewing on behalf of adamsilverstein July 23, 2026 22:59 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

mukeshpanchal27 reviewed Jul 24, 2026

View reviewed changes

Comment thread src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php Outdated

adamsilverstein and others added 3 commits September 28, 2026 14:50

Update @SInCE for sanitize_comment_statuses() to 7.2.0

303f021

Trunk is now 7.2-alpha, so the new method ships in 7.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GqepyjmFSryBt88j6f6ubY

Merge trunk into add/comment-rest-api-types-support

325b6e7

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DxbbMKz3sa741SjHuE1ZLS

adamsilverstein added 2 commits October 3, 2026 13:03

Merge remote-tracking branch 'origin/trunk' into pr9870-trunk-merge

60db941

Merge branch 'trunk' into add/comment-rest-api-types-support

dffa629

t-hamano approved these changes Oct 4, 2026

View reviewed changes

Conversation

adamsilverstein commented Sep 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing instructions

Uh oh!

github-actions Bot commented Sep 14, 2025

Test using WordPress Playground

Some things to be aware of

Uh oh!

github-actions Bot commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

t-hamano commented Sep 15, 2025

Uh oh!

adamsilverstein commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

westonruter left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

t-hamano commented Oct 3, 2026

Uh oh!

adamsilverstein commented Oct 3, 2026

Uh oh!

adamsilverstein commented Oct 4, 2026

Uh oh!

t-hamano left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

adamsilverstein commented Sep 14, 2025 •

edited

Loading

github-actions Bot commented Sep 15, 2025 •

edited

Loading

adamsilverstein commented Sep 15, 2025 •

edited

Loading