Ticket #42999: 42999.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -891 +891 @@
                 }
 
                 if ( ! empty( $schema['properties']['capabilities'] ) ) {
-                        $data['capabilities'] = (object) $user->allcaps;
+                        /**
+                         * If the user has no role on a site of the network, make sure
+                         * to populate his capabilities with Administrator ones if he
+                         * is one of the Super Administrators.
+                         */
+                        if ( ! $user->allcaps && is_multisite() ) {
+                                $site_roles = wp_roles();
+                                $admin_caps = array_merge(
+                                        $site_roles->get_role( 'administrator' )->capabilities,
+                                        array( 'administrator' => true )
+                                );
+
+                                $capabilities = array_fill_keys( array_keys( $admin_caps ), is_super_admin( $user->ID ) );
+                                $allcaps      = wp_parse_args( $user->allcaps, array_filter( $capabilities ) );
+
+                        // Otherwise use user role's capabilities.
+                        } else {
+                                $allcaps = $user->allcaps;
+                        }
+
+                        $data['capabilities'] = (object) $allcaps;
                 }
 
                 if ( ! empty( $schema['properties']['extra_capabilities'] ) ) {

tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -996 +996 @@
                 $this->assertEquals( rest_url( 'wp/v2/users/' . self::$user ), $links['self'][0]['href'] );
         }
 
+        /**
+         * @group ms-required
+         */
+        public function test_get_current_user_ms() {
+                $this->allow_user_to_manage_multisite();
+                wp_set_current_user( self::$user );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/users/me' );
+                $request->set_param( 'context', 'edit' );
+                $response = $this->server->dispatch( $request );
+                $data = $response->get_data();
+                $capabilities = $data['capabilities'];
+
+                $this->assertTrue( $capabilities->manage_options );
+
+                // Create a new site the SuperAdmin is not a member of.
+                $user_id = $this->factory->user->create();
+                $blog_id = $this->factory->blog->create( array( 'user_id' => $user_id ) );
+                switch_to_blog( $blog_id );
+
+                $request = new WP_REST_Request( 'GET', '/wp/v2/users/me' );
+                $request->set_param( 'context', 'edit' );
+                $response = $this->server->dispatch( $request );
+                $data = $response->get_data();
+
+                restore_current_blog();
+
+                $this->assertEquals( $capabilities, $data['capabilities'] );
+        }
+
         public function test_get_current_user_without_permission() {
                 wp_set_current_user( 0 );
                 $request  = new WP_REST_Request( 'GET', '/wp/v2/users/me' );