Ticket #38961: 38961.patch

tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -953 +953 @@
                 $this->assertTrue( $user_is_member );
         }
 
+        /**
+         * @ticket 38961
+         */
+        public function test_user_with_promote_users_can_add_user_to_site() {
+                if ( ! is_multisite() ) {
+                        $this->markTestSkipped( 'Test requires multisite.' );
+                }
+
+                $user_id = self::factory()->user->create( array( 'role' => 'subscriber' ) );
+
+                $user_id_promoter = self::factory()->user->create( array(
+                        'role'       => 'subscriber',
+                        'user_login' => 'promote_users',
+                ) );
+
+                $user_promoter = new WP_User( $user_id_promoter );
+                $user_promoter->add_cap( 'list_users' );
+                $user_promoter->add_cap( 'promote_users' );
+
+                wp_set_current_user( $user_id_promoter );
+
+                switch_to_blog( self::$site );
+
+                $request = new WP_REST_Request( 'PUT', '/wp/v2/users/' . $user_id );
+                $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $request->set_body_params( array(
+                        'roles' => array( 'editor' ),
+                ) );
+                $this->server->dispatch( $request ); // This is rest_cannot_edit
+
+                restore_current_blog();
+
+                $user_is_member = is_user_member_of_blog( $user_id, self::$site );
+
+                wpmu_delete_user( $user_id );
+
+                $this->assertTrue( $user_is_member );
+        }
+
         public function test_json_create_user() {
                 $this->allow_user_to_manage_multisite();
                 wp_set_current_user( self::$user );