Ticket #39000: 39000.2.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -92 +92 @@
                                         'reassign' => array(
                                                 'type'        => 'integer',
                                                 'description' => __( 'Reassign the deleted user\'s posts and links to this user ID.' ),
+                                                'required'    => true,
+                                                'sanitize_callback' => array( $this, 'check_reassign' ),
                                         ),
                                 ),
                         ),
@@ -125 +127 @@
                                         'reassign' => array(
                                                 'type'        => 'integer',
                                                 'description' => __( 'Reassign the deleted user\'s posts and links to this user ID.' ),
+                                                'required'    => true,
+                                                'sanitize_callback' => array( $this, 'check_reassign' ),
                                         ),
                                 ),
                         ),
@@ -133 +137 @@
         }
 
         /**
+         * Checks for a valid value for the reassign parameter when deleting users.
+         *
+         * @since 4.7.0
+         *
+         * @param $value
+         * @param $request
+         * @param $param
+         *
+         * @return int|bool|WP_Error
+         */
+        public function check_reassign( $value, $request, $param ) {
+                if ( is_numeric( $value ) ) {
+                        return $value;
+                }
+
+                if ( false === $value || 'false' === $value ) {
+                        return false;
+                }
+
+                return new WP_Error( 'rest_invalid_param', __( 'Invalid user parameter(s).' ), array( 'status' => 400 ) );
+        }
+
+        /**
          * Permissions check for getting all users.
          *
          * @since 4.7.0
@@ -673 +700 @@
          */
         public function delete_item( $request ) {
                 $id       = (int) $request['id'];
-                $reassign = isset( $request['reassign'] ) ? absint( $request['reassign'] ) : null;
+                $reassign = false === $request['reassign'] ? null : absint( $request['reassign'] );
                 $force    = isset( $request['force'] ) ? (bool) $request['force'] : false;
 
                 // We don't support trashing for users.

tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -1639 +1639 @@
 
                 $userdata = get_userdata( $user_id ); // cache for later
                 $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
-                $request['force'] = true;
+                $request->set_param( 'force', true );
+                $request->set_param( 'reassign', false );
                 $response = $this->server->dispatch( $request );
 
                 $this->assertEquals( 200, $response->get_status() );
@@ -1657 +1658 @@
                 $userdata = get_userdata( $user_id ); // cache for later
 
                 $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+                $request->set_param( 'reassign', false );
                 $response = $this->server->dispatch( $request );
                 $this->assertErrorResponse( 'rest_trash_not_supported', $response, 501 );
 
@@ -1678 +1680 @@
 
                 $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
                 $request['force'] = true;
+                $request->set_param( 'reassign', false );
                 $response = $this->server->dispatch( $request );
 
                 $this->assertEquals( 200, $response->get_status() );
@@ -1694 +1697 @@
                 update_site_option( 'site_admins', array( $user->user_login ) );
 
                 $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
+                $request->set_param( 'reassign', false );
                 $response = $this->server->dispatch( $request );
                 $this->assertErrorResponse( 'rest_trash_not_supported', $response, 501 );
 
@@ -1714 +1718 @@
 
                 $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
                 $request['force'] = true;
+                $request->set_param( 'reassign', false );
                 $response = $this->server->dispatch( $request );
 
                 $this->assertErrorResponse( 'rest_user_cannot_delete', $response, 403 );
@@ -1720 +1725 @@
 
                 $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
                 $request['force'] = true;
+                $request->set_param( 'reassign', false );
                 $response = $this->server->dispatch( $request );
 
                 $this->assertErrorResponse( 'rest_user_cannot_delete', $response, 403 );
@@ -1731 +1737 @@
 
                 $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/100' );
                 $request['force'] = true;
+                $request->set_param( 'reassign', false );
                 $response = $this->server->dispatch( $request );
 
                 $this->assertErrorResponse( 'rest_user_invalid_id', $response, 404 );