Ticket #53658: 53658.4.diff

src/wp-admin/user-edit.php

@@ -733 +733 @@
 
         </table>
 
+<?php if ( wp_is_application_passwords_available_for_user( $user_id ) || ! wp_is_application_passwords_supported() ) : ?>
         <div class="application-passwords hide-if-no-js" id="application-passwords-section">
                 <h2><?php _e( 'Application Passwords' ); ?></h2>
                 <p><?php _e( 'Application passwords allow authentication via non-interactive systems, such as XML-RPC or the REST API, without providing your actual password. Application passwords can be easily revoked. They cannot be used for traditional logins to your website.' ); ?></p>
@@ -797 +798 @@
                         ?>
                 </div>
                 <?php else : ?>
-                        <p><?php _e( 'The application password feature requires HTTPS, which is not enabled on this site.' ); ?></p>
+                        <p><?php _e( 'The application password feature requires HTTPS - which is not enabled on this site - or the environment type set as local.' ); ?></p>
                         <p>
                                 <?php
                                 printf(
@@ -809 +810 @@
                         </p>
                 <?php endif; ?>
         </div>
+<?php endif; ?>
 
                 <?php
                 if ( IS_PROFILE_PAGE ) {

src/wp-includes/user.php

@@ -4657 +4657 @@
         return new WP_User_Request( $post );
 }
 
+/**
+ * Checks if Application Passwords is supported.
+ *
+ * Application Passwords is supported only by sites using SSL or local environments
+ * but may be made available using the {@see 'wp_is_application_passwords_available'} filter.
+ *
+ * @since 5.9.0
+ *
+ * @return bool
+ */
+function wp_is_application_passwords_supported() {
+        return is_ssl() || 'local' === wp_get_environment_type();
+}
+
 /**
  * Checks if Application Passwords is globally available.
  *
  * By default, Application Passwords is available to all sites using SSL or to local environments.
- * Use {@see 'wp_is_application_passwords_available'} to adjust its availability.
+ * Use the {@see 'wp_is_application_passwords_available'} filter to adjust its availability.
  *
  * @since 5.6.0
  *
  * @return bool
  */
 function wp_is_application_passwords_available() {
-        $available = is_ssl() || 'local' === wp_get_environment_type();
-
         /**
          * Filters whether Application Passwords is available.
          *
@@ -4677 +4689 @@
          *
          * @param bool $available True if available, false otherwise.
          */
-        return apply_filters( 'wp_is_application_passwords_available', $available );
+        return apply_filters( 'wp_is_application_passwords_available', wp_is_application_passwords_supported() );
 }
 
 /**

tests/phpunit/tests/rest-api/rest-application-passwords-controller.php

@@ -946 +946 @@
                 $this->assertErrorResponse( 'rest_application_password_not_found', $response, 500 );
         }
 
+        /**
+         * @ticket 53658
+         */
+        public function test_supported_vs_available() {
+                wp_set_current_user( self::$admin );
+
+                $_SERVER['HTTPS'] = 'on';
+
+                $this->assertTrue( wp_is_application_passwords_supported() );
+
+                unset( $_SERVER['HTTPS'] );
+                define( 'WP_ENVIRONMENT_TYPE', 'production' );
+
+                $this->assertFalse( wp_is_application_passwords_supported() );
+                $this->assertTrue( wp_is_application_passwords_available() );
+        }
+
         /**
          * Sets up a REST API request to be authenticated using an App Password.
          *