Ticket #40556: 40556.patch

src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -471 +471 @@
                 }
 
                 $user = $this->prepare_item_for_database( $request );
+                
+                if ( ! isset( $user->user_pass ) ) {
+                        $user->user_pass = wp_generate_password( 24 );
+                }
 
                 if ( is_multisite() ) {
                         $ret = wpmu_validate_user_signup( $user->user_login, $user->user_email );
@@ -1250 +1254 @@
                                         'description' => __( 'Password for the user (never included).' ),
                                         'type'        => 'string',
                                         'context'     => array(), // Password is never displayed.
-                                        'required'    => true,
                                         'arg_options' => array(
                                                 'sanitize_callback' => array( $this, 'check_user_password' ),
                                         ),

tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -909 +909 @@
                 $this->assertEquals( array( 'editor' ), $data['roles'] );
                 $this->check_add_edit_user_response( $response );
         }
+        
+        public function test_create_item_generates_password_if_omitted() {
+                
+                $this->allow_user_to_manage_multisite();
+                wp_set_current_user( self::$user );
+
+                $params = array(
+                        'username'    => 'testuser',
+                        'email'       => 'test@example.com',
+                        'name'        => 'Test User',
+                        'nickname'    => 'testuser',
+                        'slug'        => 'test-user',
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/users' );
+                $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $request->set_body_params( $params );
+
+                $response = $this->server->dispatch( $request );
+                $data = $response->get_data();
+                
+                $user = get_userdata( $data['id'] );
+                $this->assertNotEmpty( $user );
+                $this->assertNotEmpty( $user->user_pass );
+                $this->check_add_edit_user_response( $response );
+        }
 
+        public function test_create_item_empty_password() {
+                
+                $this->allow_user_to_manage_multisite();
+                wp_set_current_user( self::$user );
+
+                $params = array(
+                        'username'    => 'testuser',
+                        'password'        => '',
+                        'email'       => 'test@example.com',
+                        'name'        => 'Test User',
+                        'nickname'    => 'testuser',
+                        'slug'        => 'test-user',
+                );
+
+                $request = new WP_REST_Request( 'POST', '/wp/v2/users' );
+                $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+                $request->set_body_params( $params );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_invalid_param', $response );
+                $invalid = $response->data['data']['params'];
+
+                $this->assertArrayHasKey( 'password', $invalid );
+                $this->assertEquals( 'Passwords cannot be empty.', $invalid['password'] );
+        }
+        
         public function test_create_item_invalid_username() {
                 $this->allow_user_to_manage_multisite();
                 wp_set_current_user( self::$user );

tests/qunit/fixtures/wp-api-generated.js

@@ -2531 +2531 @@
                             }
                         },
                         "password": {
-                            "required": true,
+                            "required": false,
                             "description": "Password for the user (never included).",
                             "type": "string"
                         },