Ticket #35914: 35914.0.diff

src/wp-includes/customize/class-wp-customize-partial.php

@@ -285 +285 @@
                 );
                 return $exports;
         }
+
+        /**
+         * Checks if the user can refresh this partial.
+         *
+         * Returns false if the user cannot manipulate one of the associated settings,
+         * or if one of the associated settings does not exist.
+         *
+         *
+         * This controls whether the partial will be
+         *
+         * capabilities to manipulate the related settings.
+         *
+         * @since 4.5.0
+         * @access public
+         *
+         * @return bool False if user can't edit one one of the related settings,
+         *                    or if one of the associated settings does not exist.
+         */
+        final public function check_capabilities() {
+                foreach ( $this->settings as $setting_id ) {
+                        $setting = $this->component->manager->get_setting( $setting_id );
+                        if ( ! $setting || ! $setting->check_capabilities() ) {
+                                return false;
+                        }
+                }
+                return true;
+        }
 }

src/wp-includes/customize/class-wp-customize-selective-refresh.php

@@ -172 +172 @@
                 $partials = array();
 
                 foreach ( $this->partials() as $partial ) {
-                        $partials[ $partial->id ] = $partial->json();
+                        if ( $partial->check_capabilities() ) {
+                                $partials[ $partial->id ] = $partial->json();
+                        }
                 }
 
                 $exports = array(
@@ -356 +358 @@
 
                         $partial = $this->get_partial( $partial_id );
 
-                        if ( ! $partial ) {
+                        if ( ! $partial || ! $partial->check_capabilities() ) {
                                 $contents[ $partial_id ] = null;
                                 continue;
                         }

tests/phpunit/tests/customize/selective-refresh.php

@@ -137 +137 @@
          * @see WP_Customize_Selective_Refresh::export_preview_data()
          */
         function test_export_preview_data() {
+                wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+                do_action( 'customize_register', $this->wp_customize );
                 $this->selective_refresh->add_partial( 'blogname', array(
                         'selector' => '#site-title',
                 ) );