Ticket #39701: 39701.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -379 +379 @@
                         return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
                 } elseif ( ! count_user_posts( $user->ID, $types ) && ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) ) {
                         return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
+                } elseif ( is_multisite() && ! is_user_member_of_blog( $user->ID ) && ! current_user_can( 'edit_user', $user->ID ) ) {
+                        return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
                 }
 
                 return true;
@@ -575 +577 @@
                         return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit this user.' ), array( 'status' => rest_authorization_required_code() ) );
                 }
 
-                if ( ! empty( $request['roles'] ) && ! current_user_can( 'edit_users' ) ) {
-                        return new WP_Error( 'rest_cannot_edit_roles', __( 'Sorry, you are not allowed to edit roles of this user.' ), array( 'status' => rest_authorization_required_code() ) );
+                if ( ! empty( $request['roles'] ) ) {
+                        if ( ! current_user_can( 'edit_users' ) ) {
+                                return new WP_Error( 'rest_cannot_edit_roles', __( 'Sorry, you are not allowed to edit roles of this user.' ), array( 'status' => rest_authorization_required_code() ) );
+                        }
+
+                        if ( is_multisite() && ! is_user_member_of_blog( $user->ID ) ) {
+                                return new WP_Error( 'rest_cannot_edit_roles', __( 'Sorry, you are not allowed to edit roles of this user.' ), array( 'status' => 400 ) );
+                        }
                 }
 
                 return true;
@@ -639 +647 @@
                 /** This action is documented in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php */
                 do_action( 'rest_insert_user', $user, $request, false );
 
-                if ( is_multisite() && ! is_user_member_of_blog( $id ) ) {
-                        add_user_to_blog( get_current_blog_id(), $id, '' );
-                }
-
                 if ( ! empty( $request['roles'] ) ) {
                         array_map( array( $user, 'add_role' ), $request['roles'] );
                 }

tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -1036 +1036 @@
                 }
         }
 
-        public function test_update_existing_network_user_on_sub_site_adds_user_to_site() {
+        public function test_update_existing_network_user_on_sub_site_does_not_add_user_to_site() {
                 if ( ! is_multisite() ) {
                         $this->markTestSkipped( 'Test requires multisite.' );
                 }
@@ -1071 +1071 @@
 
                 wpmu_delete_user( $user_id );
 
-                $this->assertTrue( $user_is_member );
+                $this->assertFalse( $user_is_member );
         }
 
         public function test_json_create_user() {
@@ -2189 +2189 @@
                 $wp_rest_additional_fields = array();
         }
 
+        /**
+         * @ticket 39701
+         */
+        public function test_get_item_from_different_site_as_site_administrator() {
+                if ( ! is_multisite() ) {
+                        $this->markTestSkipped( 'Test only runs in multisite' );
+                }
+
+                switch_to_blog( self::$site );
+                $user_id = $this->factory->user->create( array(
+                        'role' => 'author',
+                ) );
+                restore_current_blog();
+
+                wp_set_current_user( self::$user );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', $user_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_user_cannot_view', $response, 403 );
+        }
+
+        /**
+         * @ticket 39701
+         */
+        public function test_get_item_from_different_site_as_network_administrator() {
+                if ( ! is_multisite() ) {
+                        $this->markTestSkipped( 'Test only runs in multisite' );
+                }
+
+                switch_to_blog( self::$site );
+                $user_id = $this->factory->user->create( array(
+                        'role' => 'author',
+                ) );
+                restore_current_blog();
+
+                wp_set_current_user( self::$superadmin );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', $user_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->check_get_user_response( $response );
+        }
+
+        /**
+         * @ticket 39701
+         */
+        public function test_update_item_from_different_site_as_site_administrator() {
+                if ( ! is_multisite() ) {
+                        $this->markTestSkipped( 'Test only runs in multisite' );
+                }
+
+                switch_to_blog( self::$site );
+                $user_id = $this->factory->user->create( array(
+                        'role' => 'author',
+                ) );
+                restore_current_blog();
+
+                wp_set_current_user( self::$user );
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/users/%d', $user_id ) );
+                $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $request->set_body_params( array( 'first_name' => 'New Name' ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_edit', $response, 403 );
+        }
+
+        /**
+         * @ticket 39701
+         */
+        public function test_update_item_from_different_site_as_network_administrator() {
+                if ( ! is_multisite() ) {
+                        $this->markTestSkipped( 'Test only runs in multisite' );
+                }
+
+                switch_to_blog( self::$site );
+                $user_id = $this->factory->user->create( array(
+                        'role' => 'author',
+                ) );
+                restore_current_blog();
+
+                wp_set_current_user( self::$superadmin );
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/users/%d', $user_id ) );
+                $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $request->set_body_params( array( 'first_name' => 'New Name' ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->check_add_edit_user_response( $response, true );
+        }
+
+        /**
+         * @ticket 39701
+         */
+        public function test_update_item_from_different_site_as_network_administrator_with_roles() {
+                if ( ! is_multisite() ) {
+                        $this->markTestSkipped( 'Test only runs in multisite' );
+                }
+
+                switch_to_blog( self::$site );
+                $user_id = $this->factory->user->create( array(
+                        'role' => 'author',
+                ) );
+                restore_current_blog();
+
+                wp_set_current_user( self::$superadmin );
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/users/%d', $user_id ) );
+                $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $request->set_body_params( array( 'roles' => array( 'subscriber' ) ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_edit_roles', $response, 400 );
+        }
+
         public function additional_field_get_callback( $object ) {
                 return get_user_meta( $object['id'], 'my_custom_int', true );
         }