Ticket #43210: 43210.diff

src/wp-includes/capabilities.php

@@ -248 +248 @@
 
                         $caps[] = $post_type->cap->publish_posts;
                         break;
+                case 'manage_option':
+                        $caps[] = 'manage_options';
+                        $option = $args[0];
+
+                        if ( has_filter( "auth_option_{$option}" ) ) {
+                                /**
+                                 * Filters whether the user is allowed to manage an option.
+                                 *
+                                 * @since 5.0.0
+                                 *
+                                 * @param bool   $allowed Whether the user can manage the option. Default false.
+                                 * @param string $option  The option name.
+                                 * @param int    $user_id User ID.
+                                 */
+                                $allowed = apply_filters( "auth_option_{$option}", false, $option, $user_id );
+
+                                if ( ! $allowed ) {
+                                        $caps[] = $cap;
+                                }
+                        }
+                        break;
                 case 'edit_post_meta':
                 case 'delete_post_meta':
                 case 'add_post_meta':

src/wp-includes/option.php

@@ -2032 +2032 @@
  *
  * @since 2.7.0
  * @since 4.7.0 `$args` can be passed to set flags on the setting, similar to `register_meta()`.
+ * @since 5.0.0 Introduced the `$auth_callback` argument.
  *
  * @global array $new_whitelist_options
  * @global array $wp_registered_settings
@@ -2046 +2047 @@
  *                                       Valid values are 'string', 'boolean', 'integer', and 'number'.
  *     @type string   $description       A description of the data attached to this setting.
  *     @type callable $sanitize_callback A callback function that sanitizes the option's value.
+ *     @type callable $auth_callback     A callback function to use when performing a manage_option check.
  *     @type bool     $show_in_rest      Whether data associated with this setting should be included in the REST API.
  *     @type mixed    $default           Default value when calling `get_option()`.
  * }
@@ -2058 +2060 @@
                 'group'             => $option_group,
                 'description'       => '',
                 'sanitize_callback' => null,
+                'auth_callback'     => null,
                 'show_in_rest'      => false,
         );
 
@@ -2113 +2116 @@
         if ( ! empty( $args['sanitize_callback'] ) ) {
                 add_filter( "sanitize_option_{$option_name}", $args['sanitize_callback'] );
         }
+        if ( ! empty( $args['auth_callback'] ) ) {
+                add_filter( "auth_option_{$option_name}", $args['auth_callback'], 10, 3 );
+        }
         if ( array_key_exists( 'default', $args ) ) {
                 add_filter( "default_option_{$option_name}", 'filter_default_option', 10, 3 );
         }
@@ -2182 +2188 @@
                         remove_filter( "sanitize_option_{$option_name}", $wp_registered_settings[ $option_name ]['sanitize_callback'] );
                 }
 
+                // Remove the auth callback if one was set during registration.
+                if ( ! empty( $wp_registered_settings[ $option_name ]['auth_callback'] ) ) {
+                        remove_filter( "auth_option_{$option_name}", $wp_registered_settings[ $option_name ]['auth_callback'], 10 );
+                }
+
                 unset( $wp_registered_settings[ $option_name ] );
         }
 }