Changeset 36643

Timestamp:

02/23/2016 06:13:30 PM (11 years ago)

Author:

westonruter

Message:

Customize: Skip exporting partials to client and handling rendering requests if user can't modify associated settings.

Introduces WP_Customize_Partial::check_capabilities() for parity with WP_Customize_Control::check_capabilities().

See #27355.
Fixes #35914.

Location:

trunk

Files:

• src/wp-includes/customize/class-wp-customize-partial.php (modified) (2 diffs)
• src/wp-includes/customize/class-wp-customize-selective-refresh.php (modified) (2 diffs)
• tests/phpunit/tests/customize/partial.php (modified) (2 diffs)
• tests/phpunit/tests/customize/selective-refresh.php (modified) (2 diffs)

trunk/src/wp-includes/customize/class-wp-customize-partial.php

@@ -71 +71 @@
 
         /**
-         * All settings tied to the partial.
-         *
-         * @access public
-         * @since 4.5.0
-         * @var WP_Customize_Setting[]
+         * IDs for settings tied to the partial.
+         *
+         * @access public
+         * @since 4.5.0
+         * @var array
          */
         public $settings;
@@ -286 +286 @@
                 return $exports;
         }
+
+        /**
+         * Checks if the user can refresh this partial.
+         *
+         * Returns false if the user cannot manipulate one of the associated settings,
+         * or if one of the associated settings does not exist.
+         *
+         * @since 4.5.0
+         * @access public
+         *
+         * @return bool False if user can't edit one one of the related settings,
+         *                    or if one of the associated settings does not exist.
+         */
+        final public function check_capabilities() {
+                foreach ( $this->settings as $setting_id ) {
+                        $setting = $this->component->manager->get_setting( $setting_id );
+                        if ( ! $setting || ! $setting->check_capabilities() ) {
+                                return false;
+                        }
+                }
+                return true;
+        }
 }

trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php

@@ -173 +173 @@
 
                 foreach ( $this->partials() as $partial ) {
-                        $partials[ $partial->id ] = $partial->json();
+                        if ( $partial->check_capabilities() ) {
+                                $partials[ $partial->id ] = $partial->json();
+                        }
                 }
 
@@ -357 +359 @@
                         $partial = $this->get_partial( $partial_id );
 
-                        if ( ! $partial ) {
+                        if ( ! $partial || ! $partial->check_capabilities() ) {
                                 $contents[ $partial_id ] = null;
                                 continue;

trunk/tests/phpunit/tests/customize/partial.php

@@ -274 +274 @@
 
         /**
-         * Test WP_Customize_Partial::json() default.
+         * Test WP_Customize_Partial::json().
          *
          * @see WP_Customize_Partial::json()
@@ -302 +302 @@
 
         /**
+         * Test WP_Customize_Partial::check_capabilities().
+         *
+         * @see WP_Customize_Partial::check_capabilities()
+         */
+        function test_check_capabilities() {
+                wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+                do_action( 'customize_register', $this->wp_customize );
+                $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
+                        'settings' => array( 'blogname' ),
+                ) );
+                $this->assertTrue( $partial->check_capabilities() );
+
+                $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
+                        'settings' => array( 'blogname', 'non_existing' ),
+                ) );
+                $this->assertFalse( $partial->check_capabilities() );
+
+                $this->wp_customize->add_setting( 'top_secret_message', array(
+                        'capability' => 'top_secret_clearance',
+                ) );
+                $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
+                        'settings' => array( 'blogname', 'top_secret_clearance' ),
+                ) );
+                $this->assertFalse( $partial->check_capabilities() );
+        }
+
+        /**
          * Tear down.
          */

trunk/tests/phpunit/tests/customize/selective-refresh.php

@@ -138 +138 @@
          */
         function test_export_preview_data() {
+                $user_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
+                wp_set_current_user( $user_id );
+                $user = new WP_User( $user_id );
+                do_action( 'customize_register', $this->wp_customize );
+                $user->remove_cap( 'top_secret_clearance' );
+                $this->wp_customize->add_setting( 'top_secret_message', array(
+                        'capability' => 'top_secret_clearance', // The administrator role lacks this.
+                ) );
                 $this->selective_refresh->add_partial( 'blogname', array(
                         'selector' => '#site-title',
+                ) );
+                $this->selective_refresh->add_partial( 'top_secret_message', array(
+                        'settings' => array( 'top_secret_message' ),
                 ) );
                 ob_start();
@@ -150 +161 @@
                 $this->assertInternalType( 'array', $exported_data['partials'] );
                 $this->assertArrayHasKey( 'blogname', $exported_data['partials'] );
+                $this->assertArrayNotHasKey( 'top_secret_message', $exported_data['partials'] );
                 $this->assertEquals( '#site-title', $exported_data['partials']['blogname']['selector'] );
                 $this->assertArrayHasKey( 'renderQueryVar', $exported_data );