Changeset 36611

Timestamp:

02/22/2016 05:30:30 AM (9 years ago)

Author:

westonruter

Message:

Customize: Prevent PHP notice and JS error caused by widgets and nav menus components if user only has customize capability.

Short-circuits components from initializing their hooks needlessly if current user lacks required capability.

Fixes #35895.

Location:

trunk

Files:

• src/wp-includes/class-wp-customize-nav-menus.php (modified) (1 diff)
• src/wp-includes/class-wp-customize-widgets.php (modified) (1 diff)
• tests/phpunit/tests/customize/widgets.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-customize-nav-menus.php

@@ -48 +48 @@
         $this->previewed_menus = array();
         $this->manager         = $manager;
+
+        // Skip useless hooks when the user can't manage nav menus anyway.
+        if ( ! current_user_can( 'edit_theme_options' ) ) {
+            return;
+        }
 
         add_filter( 'customize_refresh_nonces', array( $this, 'filter_nonces' ) );

trunk/src/wp-includes/class-wp-customize-widgets.php

@@ -84 +84 @@
     public function __construct( $manager ) {
         $this->manager = $manager;
+
+        // Skip useless hooks when the user can't manage widgets anyway.
+        if ( ! current_user_can( 'edit_theme_options' ) ) {
+            return;
+        }
 
         add_filter( 'customize_dynamic_setting_args',          array( $this, 'filter_customize_dynamic_setting_args' ), 10, 2 );

trunk/tests/phpunit/tests/customize/widgets.php

@@ -24 +24 @@
         parent::setUp();
         require_once( ABSPATH . WPINC . '/class-wp-customize-manager.php' );
+
+        $user_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
+        wp_set_current_user( $user_id );
         $GLOBALS['wp_customize'] = new WP_Customize_Manager();
         $this->manager = $GLOBALS['wp_customize'];
@@ -41 +44 @@
         remove_action( 'after_setup_theme', 'twentysixteen_setup' );
         remove_action( 'customize_register', 'twentysixteen_customize_register', 11 );
-
-        $user_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
-        wp_set_current_user( $user_id );
 
         $this->backup_registered_sidebars = $GLOBALS['wp_registered_sidebars'];