Commit bd3d22b035 for wordpress.org

commit bd3d22b035332acc9084ac4e2834ac010a2afbd8
Author: adamsilverstein <adamsilverstein@git.wordpress.org>
Date:   Mon Oct 19 04:21:51 2026 +0000

    REST API: Enable filtering comments by multiple statuses.

    `WP_Comment_Query` has always supported an array of statuses. The `status` collection parameter is now defined as an array of strings, so it accepts a comma-separated list (`?status=approve,hold`) or an array (`?status[]=approve&status[]=hold`). Values are sanitized by the new `WP_REST_Comments_Controller::sanitize_comment_statuses()` method.

    Single status requests work as before, and the permission check is unchanged: unauthenticated requests may only use the default `approve` status. Because the parameter is now always an array after sanitization, code reading `$request['status']` or `status` in the `rest_comment_query` filter receives an array instead of a string.

    Props adamsilverstein, westonruter, swissspidy, timothyblynjacobs, mukesh27, wildworks.
    Fixes #63982.


    Built from https://develop.svn.wordpress.org/trunk@64494


    git-svn-id: http://core.svn.wordpress.org/trunk@63644 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
index a10d29299d..442e100f3e 100644
--- a/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
+++ b/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
@@ -185,7 +185,7 @@ class WP_REST_Comments_Controller extends WP_REST_Controller {

 					foreach ( $protected_params as $param ) {
 						if ( 'status' === $param ) {
-							if ( 'approve' !== $request[ $param ] ) {
+							if ( array( 'approve' ) !== $request[ $param ] ) {
 								$forbidden_params[] = $param;
 							}
 						} elseif ( 'type' === $param ) {
@@ -228,7 +228,7 @@ class WP_REST_Comments_Controller extends WP_REST_Controller {
 		if ( ! current_user_can( 'edit_posts' ) ) {
 			foreach ( $protected_params as $param ) {
 				if ( 'status' === $param ) {
-					if ( 'approve' !== $request[ $param ] ) {
+					if ( array( 'approve' ) !== $request[ $param ] ) {
 						$forbidden_params[] = $param;
 					}
 				} elseif ( 'type' === $param ) {
@@ -2175,10 +2175,13 @@ class WP_REST_Comments_Controller extends WP_REST_Controller {
 		);

 		$query_params['status'] = array(
-			'default'           => 'approve',
-			'description'       => __( 'Limit result set to comments assigned a specific status. Requires authorization.' ),
-			'sanitize_callback' => 'sanitize_key',
-			'type'              => 'string',
+			'default'           => array( 'approve' ),
+			'description'       => __( 'Limit result set to comments assigned one or more statuses. Requires authorization.' ),
+			'type'              => 'array',
+			'items'             => array(
+				'type' => 'string',
+			),
+			'sanitize_callback' => array( $this, 'sanitize_comment_statuses' ),
 			'validate_callback' => 'rest_validate_request_arg',
 		);

@@ -2516,6 +2519,29 @@ class WP_REST_Comments_Controller extends WP_REST_Controller {
 		return '' !== $check['comment_content'];
 	}

+	/**
+	 * Sanitizes a single comment status or a list of comment statuses.
+	 *
+	 * @since 7.2.0
+	 *
+	 * @param string[]|string $statuses Comment status or array of comment statuses.
+	 * @return string[] Sanitized array of comment statuses.
+	 * @phpstan-return list<non-empty-lowercase-string>
+	 */
+	public function sanitize_comment_statuses( $statuses ): array {
+		$statuses = array_unique( array_map( 'sanitize_key', wp_parse_list( $statuses ) ) );
+
+		// Only drop empty values. A literal '0' is a queryable status, as comments are held with `comment_approved` of '0'.
+		$statuses = array_filter(
+			$statuses,
+			static function ( $status ) {
+				return '' !== $status;
+			}
+		);
+
+		return array_values( $statuses );
+	}
+
 	/**
 	 * Checks that a post can receive a comment or a note from the current user.
 	 *
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 033f6fa7af..82999cc1f4 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-64493';
+$wp_version = '7.2-alpha-64494';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.