Changeset 39179 for trunk/tests/phpunit/tests/user/capabilities.php

Timestamp:

11/09/2016 03:41:07 AM (8 years ago)

Author:

rmccue

Message:

Roles/Capabilities: Add meta-caps for comment, term, and user meta.

Additionally, use these meta-caps in the REST API endpoints.

Previously, register_meta()'s auth_callback had no effect for non-post meta. This introduces {add,edit,delete}_{comment,term,user}_meta meta-caps to match the existing post meta capabilities. These are currently only used in the REST API.

Props tharsheblows, boonebgorges.
Fixes #38303, fixes #38412.

File:

• trunk/tests/phpunit/tests/user/capabilities.php (modified) (2 diffs)

trunk/tests/phpunit/tests/user/capabilities.php

@@ -432 +432 @@
             $expected['add_post_meta'],
             $expected['edit_comment'],
+            $expected['edit_comment_meta'],
+            $expected['delete_comment_meta'],
+            $expected['add_comment_meta'],
             $expected['edit_term'],
             $expected['delete_term'],
             $expected['assign_term'],
-            $expected['delete_user']
+            $expected['edit_term_meta'],
+            $expected['delete_term_meta'],
+            $expected['add_term_meta'],
+            $expected['delete_user'],
+            $expected['edit_user_meta'],
+            $expected['delete_user_meta'],
+            $expected['add_user_meta']
         );
 
@@ -1664 +1673 @@
         $wp_roles->reinit();
     }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_no_one_can_edit_user_meta_for_non_existent_term() {
+        wp_set_current_user( self::$super_admin->ID );
+        $this->assertFalse( current_user_can( 'edit_user_meta', 999999 ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_user_can_edit_user_meta() {
+        wp_set_current_user( self::$users['administrator']->ID );
+        if ( is_multisite() ) {
+            grant_super_admin( self::$users['administrator']->ID );
+        }
+        $this->assertTrue( current_user_can( 'edit_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_user_cannot_edit_user_meta() {
+        wp_set_current_user( self::$users['editor']->ID );
+        $this->assertFalse( current_user_can( 'edit_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_no_one_can_delete_user_meta_for_non_existent_term() {
+        wp_set_current_user( self::$super_admin->ID );
+        $this->assertFalse( current_user_can( 'delete_user_meta', 999999, 'foo' ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_user_can_delete_user_meta() {
+        wp_set_current_user( self::$users['administrator']->ID );
+        if ( is_multisite() ) {
+            grant_super_admin( self::$users['administrator']->ID );
+        }
+        $this->assertTrue( current_user_can( 'delete_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_user_cannot_delete_user_meta() {
+        wp_set_current_user( self::$users['editor']->ID );
+        $this->assertFalse( current_user_can( 'delete_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_no_one_can_add_user_meta_for_non_existent_term() {
+        wp_set_current_user( self::$super_admin->ID );
+        $this->assertFalse( current_user_can( 'add_user_meta', 999999, 'foo' ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_user_can_add_user_meta() {
+        wp_set_current_user( self::$users['administrator']->ID );
+        if ( is_multisite() ) {
+            grant_super_admin( self::$users['administrator']->ID );
+        }
+        $this->assertTrue( current_user_can( 'add_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+    }
+
+    /**
+     * @ticket 38412
+     */
+    public function test_user_cannot_add_user_meta() {
+        wp_set_current_user( self::$users['editor']->ID );
+        $this->assertFalse( current_user_can( 'add_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+    }
 }