Changeset 39426

Timestamp:

12/02/2016 06:53:59 AM (8 years ago)

Author:

pento

Message:

REST API: Require the reassign parameter when deleting users.

When deleting a user through the WordPress admin, a specific decision is presented - whether to assign all of the user's posts to another user, or to delete all of the posts.

This change requires reassign as a parameter in the corresponding REST API endpoint, so that content isn't accidentally lost.

Props jeremyfelt.
Fixes #39000.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (4 diffs)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (8 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -93 +93 @@
                         'type'        => 'integer',
                         'description' => __( 'Reassign the deleted user\'s posts and links to this user ID.' ),
+                        'required'    => true,
+                        'sanitize_callback' => array( $this, 'check_reassign' ),
                     ),
                 ),
@@ -126 +128 @@
                         'type'        => 'integer',
                         'description' => __( 'Reassign the deleted user\'s posts and links to this user ID.' ),
+                        'required'    => true,
+                        'sanitize_callback' => array( $this, 'check_reassign' ),
                     ),
                 ),
@@ -131 +135 @@
             'schema' => array( $this, 'get_public_item_schema' ),
         ));
+    }
+
+    /**
+     * Checks for a valid value for the reassign parameter when deleting users.
+     *
+     * The value can be an integer, 'false', false, or ''.
+     *
+     * @since 4.7.0
+     *
+     * @param int|bool        $value   The value passed to the reassign parameter.
+     * @param WP_REST_Request $request Full details about the request.
+     * @param string          $param   The parameter that is being sanitized.
+     *
+     * @return int|bool|WP_Error
+     */
+    public function check_reassign( $value, $request, $param ) {
+        if ( is_numeric( $value ) ) {
+            return $value;
+        }
+
+        if ( empty( $value ) || false === $value || 'false' === $value ) {
+            return false;
+        }
+
+        return new WP_Error( 'rest_invalid_param', __( 'Invalid user parameter(s).' ), array( 'status' => 400 ) );
     }
 
@@ -674 +703 @@
     public function delete_item( $request ) {
         $id       = (int) $request['id'];
-        $reassign = isset( $request['reassign'] ) ? absint( $request['reassign'] ) : null;
+        $reassign = false === $request['reassign'] ? null : absint( $request['reassign'] );
         $force    = isset( $request['force'] ) ? (bool) $request['force'] : false;
 

trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -1640 +1640 @@
         $userdata = get_userdata( $user_id ); // cache for later
         $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
-        $request['force'] = true;
+        $request->set_param( 'force', true );
+        $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
 
@@ -1658 +1659 @@
 
         $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+        $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
         $this->assertErrorResponse( 'rest_trash_not_supported', $response, 501 );
@@ -1679 +1681 @@
         $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
         $request['force'] = true;
+        $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
 
@@ -1695 +1698 @@
 
         $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
+        $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
         $this->assertErrorResponse( 'rest_trash_not_supported', $response, 501 );
@@ -1715 +1719 @@
         $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
         $request['force'] = true;
+        $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
 
@@ -1721 +1726 @@
         $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
         $request['force'] = true;
+        $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
 
@@ -1732 +1738 @@
         $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/100' );
         $request['force'] = true;
+        $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
 
@@ -1777 +1784 @@
 
         $this->assertErrorResponse( 'rest_user_invalid_reassign', $response, 400 );
+    }
+
+    public function test_delete_user_invalid_reassign_passed_as_string() {
+        $user_id = $this->factory->user->create();
+
+        $this->allow_user_to_manage_multisite();
+        wp_set_current_user( self::$user );
+
+        $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+        $request['force'] = true;
+        $request->set_param( 'reassign', 'null' );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+    }
+
+    public function test_delete_user_reassign_passed_as_boolean_false_trashes_post() {
+        $user_id = $this->factory->user->create();
+
+        $this->allow_user_to_manage_multisite();
+        wp_set_current_user( self::$user );
+
+        $test_post = $this->factory->post->create(array(
+            'post_author' => $user_id,
+        ));
+
+        $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+        $request['force'] = true;
+        $request->set_param( 'reassign', false );
+        $this->server->dispatch( $request );
+
+        $test_post = get_post( $test_post );
+        $this->assertEquals( 'trash', $test_post->post_status );
+    }
+
+    public function test_delete_user_reassign_passed_as_string_false_trashes_post() {
+        $user_id = $this->factory->user->create();
+
+        $this->allow_user_to_manage_multisite();
+        wp_set_current_user( self::$user );
+
+        $test_post = $this->factory->post->create(array(
+            'post_author' => $user_id,
+        ));
+
+        $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+        $request['force'] = true;
+        $request->set_param( 'reassign', 'false' );
+        $this->server->dispatch( $request );
+
+        $test_post = get_post( $test_post );
+        $this->assertEquals( 'trash', $test_post->post_status );
+    }
+
+    public function test_delete_user_reassign_passed_as_empty_string_trashes_post() {
+        $user_id = $this->factory->user->create();
+
+        $this->allow_user_to_manage_multisite();
+        wp_set_current_user( self::$user );
+
+        $test_post = $this->factory->post->create(array(
+            'post_author' => $user_id,
+        ));
+
+        $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+        $request['force'] = true;
+        $request->set_param( 'reassign', '' );
+        $this->server->dispatch( $request );
+
+        $test_post = get_post( $test_post );
+        $this->assertEquals( 'trash', $test_post->post_status );
+    }
+
+    public function test_delete_user_reassign_passed_as_0_reassigns_author() {
+        $user_id = $this->factory->user->create();
+
+        $this->allow_user_to_manage_multisite();
+        wp_set_current_user( self::$user );
+
+        $test_post = $this->factory->post->create(array(
+            'post_author' => $user_id,
+        ));
+
+        $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+        $request['force'] = true;
+        $request->set_param( 'reassign', 0 );
+        $this->server->dispatch( $request );
+
+        $test_post = get_post( $test_post );
+        $this->assertEquals( 0, $test_post->post_author );
     }