Changeset 36643

Timestamp:

02/23/2016 06:13:30 PM (9 years ago)

Author:

westonruter

Message:

Customize: Skip exporting partials to client and handling rendering requests if user can't modify associated settings.

Introduces WP_Customize_Partial::check_capabilities() for parity with WP_Customize_Control::check_capabilities().

See #27355.
Fixes #35914.

Location:

trunk

Files:

• src/wp-includes/customize/class-wp-customize-partial.php (modified) (2 diffs)
• src/wp-includes/customize/class-wp-customize-selective-refresh.php (modified) (2 diffs)
• tests/phpunit/tests/customize/partial.php (modified) (2 diffs)
• tests/phpunit/tests/customize/selective-refresh.php (modified) (2 diffs)

trunk/src/wp-includes/customize/class-wp-customize-partial.php

@@ -71 +71 @@
 
     /**
-     * All settings tied to the partial.
-     *
-     * @access public
-     * @since 4.5.0
-     * @var WP_Customize_Setting[]
+     * IDs for settings tied to the partial.
+     *
+     * @access public
+     * @since 4.5.0
+     * @var array
      */
     public $settings;
@@ -286 +286 @@
         return $exports;
     }
+
+    /**
+     * Checks if the user can refresh this partial.
+     *
+     * Returns false if the user cannot manipulate one of the associated settings,
+     * or if one of the associated settings does not exist.
+     *
+     * @since 4.5.0
+     * @access public
+     *
+     * @return bool False if user can't edit one one of the related settings,
+     *                    or if one of the associated settings does not exist.
+     */
+    final public function check_capabilities() {
+        foreach ( $this->settings as $setting_id ) {
+            $setting = $this->component->manager->get_setting( $setting_id );
+            if ( ! $setting || ! $setting->check_capabilities() ) {
+                return false;
+            }
+        }
+        return true;
+    }
 }

trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php

@@ -173 +173 @@
 
         foreach ( $this->partials() as $partial ) {
-            $partials[ $partial->id ] = $partial->json();
+            if ( $partial->check_capabilities() ) {
+                $partials[ $partial->id ] = $partial->json();
+            }
         }
 
@@ -357 +359 @@
             $partial = $this->get_partial( $partial_id );
 
-            if ( ! $partial ) {
+            if ( ! $partial || ! $partial->check_capabilities() ) {
                 $contents[ $partial_id ] = null;
                 continue;

trunk/tests/phpunit/tests/customize/partial.php

@@ -274 +274 @@
 
     /**
-     * Test WP_Customize_Partial::json() default.
+     * Test WP_Customize_Partial::json().
      *
      * @see WP_Customize_Partial::json()
@@ -302 +302 @@
 
     /**
+     * Test WP_Customize_Partial::check_capabilities().
+     *
+     * @see WP_Customize_Partial::check_capabilities()
+     */
+    function test_check_capabilities() {
+        wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+        do_action( 'customize_register', $this->wp_customize );
+        $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
+            'settings' => array( 'blogname' ),
+        ) );
+        $this->assertTrue( $partial->check_capabilities() );
+
+        $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
+            'settings' => array( 'blogname', 'non_existing' ),
+        ) );
+        $this->assertFalse( $partial->check_capabilities() );
+
+        $this->wp_customize->add_setting( 'top_secret_message', array(
+            'capability' => 'top_secret_clearance',
+        ) );
+        $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
+            'settings' => array( 'blogname', 'top_secret_clearance' ),
+        ) );
+        $this->assertFalse( $partial->check_capabilities() );
+    }
+
+    /**
      * Tear down.
      */

trunk/tests/phpunit/tests/customize/selective-refresh.php

@@ -138 +138 @@
      */
     function test_export_preview_data() {
+        $user_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
+        wp_set_current_user( $user_id );
+        $user = new WP_User( $user_id );
+        do_action( 'customize_register', $this->wp_customize );
+        $user->remove_cap( 'top_secret_clearance' );
+        $this->wp_customize->add_setting( 'top_secret_message', array(
+            'capability' => 'top_secret_clearance', // The administrator role lacks this.
+        ) );
         $this->selective_refresh->add_partial( 'blogname', array(
             'selector' => '#site-title',
+        ) );
+        $this->selective_refresh->add_partial( 'top_secret_message', array(
+            'settings' => array( 'top_secret_message' ),
         ) );
         ob_start();
@@ -150 +161 @@
         $this->assertInternalType( 'array', $exported_data['partials'] );
         $this->assertArrayHasKey( 'blogname', $exported_data['partials'] );
+        $this->assertArrayNotHasKey( 'top_secret_message', $exported_data['partials'] );
         $this->assertEquals( '#site-title', $exported_data['partials']['blogname']['selector'] );
         $this->assertArrayHasKey( 'renderQueryVar', $exported_data );