Changeset 35871

Timestamp:

12/11/2015 09:54:05 PM (9 years ago)

Author:

johnbillion

Message:

Introduce tests for the unfiltered_upload capability, which no user should have (unless the ALLOW_UNFILTERED_UPLOADS constant is defined).

See #35024

File:

• trunk/tests/phpunit/tests/user/capabilities.php (modified) (2 diffs)

trunk/tests/phpunit/tests/user/capabilities.php

@@ -311 +311 @@
     }
 
+    // special case for unfiltered uploads
+    function test_unfiltered_upload_caps() {
+        $users = array(
+            'administrator' => self::factory()->user->create_and_get( array( 'role' => 'administrator' ) ),
+            'editor'        => self::factory()->user->create_and_get( array( 'role' => 'editor' ) ),
+            'author'        => self::factory()->user->create_and_get( array( 'role' => 'author' ) ),
+            'contributor'   => self::factory()->user->create_and_get( array( 'role' => 'contributor' ) ),
+            'subscriber'    => self::factory()->user->create_and_get( array( 'role' => 'subscriber' ) ),
+        );
+
+        $this->assertFalse( defined( 'ALLOW_UNFILTERED_UPLOADS' ) );
+
+        // no-one should have this cap
+        foreach ( $users as $role => $user ) {
+            $this->assertFalse( $user->has_cap( 'unfiltered_upload' ), "User with the {$role} role should not have the unfiltered_upload capability" );
+            $this->assertFalse( user_can( $user, 'unfiltered_upload' ), "User with the {$role} role should not have the unfiltered_upload capability" );
+        }
+
+    }
+
     function test_super_admin_caps() {
         if ( ! is_multisite() ) {
@@ -330 +350 @@
         $this->assertFalse( $user->has_cap( 'do_not_allow' ), 'Super Admins should not have the do_not_allow capability' );
         $this->assertFalse( user_can( $user, 'do_not_allow' ), 'Super Admins should not have the do_not_allow capability' );
+
+        $this->assertFalse( defined( 'ALLOW_UNFILTERED_UPLOADS' ) );
+        $this->assertFalse( $user->has_cap( 'unfiltered_upload' ), 'Super Admins should not have the unfiltered_upload capability' );
+        $this->assertFalse( user_can( $user, 'unfiltered_upload' ), 'Super Admins should not have the unfiltered_upload capability' );
     }