API accepts non-ObjectID id's when creating posts

Issue Summary

It’s possible to POST to the /posts/ endpoint including a numeric id attribute which is successfully saved to the database. When later trying to edit that post the server raises a 422 ValidationError with the message:

Saving failed: Validation (matches) failed for id

Steps to Reproduce

1. Use Postman or similar to send a POST /posts/ request with a numeric ID property in the post’s JSON
2. Open the new post in the admin area’s editor
3. Attempt to save it

We should be ignoring (ideally) or at least validating ID attributes when creating posts via the API.

Technical details:

• Ghost Version: 1.11.0

[mdornseif]

I would suggest that forbidding is better than ignoring. So better send an 400 Bad Request (or 422) status back then silently drop the parameter.

[naz]

With JSON Schema validations landing in master for posts and tags Admin API endpoints, id fields are now stripped from the input and ignored during validation phase 👍