Make WordPress Core


Ignore:
Timestamp:
04/20/2015 07:26:05 AM (11 years ago)
Author:
pento
Message:

In Multisite, prevent plugins from unintentionally switching sites.

Props mdawaffe.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/tests/phpunit/tests/user/capabilities.php

    r31190 r32173  
    696696    }
    697697
     698    function test_borked_current_user_can_for_blog() {
     699        if ( ! is_multisite() ) {
     700            $this->markTestSkipped( 'Test only runs in multisite' );
     701            return;
     702        }
     703
     704        $orig_blog_id = get_current_blog_id();
     705        $blog_id = $this->factory->blog->create();
     706
     707        $nullify_current_user = function() {
     708            // Prevents fatal errors in ::tearDown()'s and other uses of restore_current_blog()
     709            $function_stack = wp_debug_backtrace_summary( null, 0, false );
     710            if ( in_array( 'restore_current_blog', $function_stack ) ) {
     711                return;
     712            }
     713            $GLOBALS['current_user'] = null;
     714        };
     715
     716        $nullify_current_user_and_keep_nullifying_user = function() use ( $nullify_current_user ) {
     717            $nullify_current_user();
     718
     719            add_action( 'set_current_user', $nullify_current_user );
     720        };
     721
     722        $nullify_current_user();
     723
     724        add_action( 'switch_blog', $nullify_current_user_and_keep_nullifying_user );
     725
     726        current_user_can_for_blog( $blog_id, 'edit_posts' );
     727
     728        $this->assertEquals( $orig_blog_id, get_current_blog_id() );
     729    }
     730
    698731    /**
    699732     * @ticket 28374
Note: See TracChangeset for help on using the changeset viewer.