Changeset 39438

Timestamp:

12/02/2016 10:10:01 PM (8 years ago)

Author:

jeremyfelt

Message:

REST API: Disable DELETE requests for users in multisite.

In wp-admin, users are removed from individual sites rather than deleted. A user can only be deleted from the network admin.

Until support for a PUT request that removes a user's site and content associations is available, DELETE requests are disabled to avoid possible issues with lost content.

Props jnylen0, rachelbaker.
Fixes #38962.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (11 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -702 +702 @@
      */
     public function delete_item( $request ) {
+        // We don't support delete requests in multisite.
+        if ( is_multisite() ) {
+            return new WP_Error( 'rest_cannot_delete', __( 'The user cannot be deleted.' ), array( 'status' => 501 ) );
+        }
+
         $id       = (int) $request['id'];
         $reassign = false === $request['reassign'] ? null : absint( $request['reassign'] );

trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -1644 +1644 @@
         $response = $this->server->dispatch( $request );
 
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
+
         $this->assertEquals( 200, $response->get_status() );
         $data = $response->get_data();
@@ -1661 +1667 @@
         $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
+
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
+
         $this->assertErrorResponse( 'rest_trash_not_supported', $response, 501 );
 
@@ -1684 +1697 @@
         $response = $this->server->dispatch( $request );
 
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
+
         $this->assertEquals( 200, $response->get_status() );
         $data = $response->get_data();
@@ -1700 +1719 @@
         $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
+
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
+
         $this->assertErrorResponse( 'rest_trash_not_supported', $response, 501 );
 
@@ -1740 +1766 @@
         $request->set_param( 'reassign', false );
         $response = $this->server->dispatch( $request );
+
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
 
         $this->assertErrorResponse( 'rest_user_invalid_id', $response, 404 );
@@ -1765 +1797 @@
         $response = $this->server->dispatch( $request );
 
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
+
         $this->assertEquals( 200, $response->get_status() );
 
@@ -1783 +1821 @@
         $response = $this->server->dispatch( $request );
 
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
+
         $this->assertErrorResponse( 'rest_user_invalid_reassign', $response, 400 );
     }
@@ -1813 +1857 @@
         $request['force'] = true;
         $request->set_param( 'reassign', false );
-        $this->server->dispatch( $request );
+        $response = $this->server->dispatch( $request );
+
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
 
         $test_post = get_post( $test_post );
@@ -1832 +1882 @@
         $request['force'] = true;
         $request->set_param( 'reassign', 'false' );
-        $this->server->dispatch( $request );
+        $response = $this->server->dispatch( $request );
+
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
 
         $test_post = get_post( $test_post );
@@ -1851 +1907 @@
         $request['force'] = true;
         $request->set_param( 'reassign', '' );
-        $this->server->dispatch( $request );
+        $response = $this->server->dispatch( $request );
+
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
 
         $test_post = get_post( $test_post );
@@ -1870 +1932 @@
         $request['force'] = true;
         $request->set_param( 'reassign', 0 );
-        $this->server->dispatch( $request );
+        $response = $this->server->dispatch( $request );
+
+        // Not implemented in multisite.
+        if ( is_multisite() ) {
+            $this->assertErrorResponse( 'rest_cannot_delete', $response, 501 );
+            return;
+        }
 
         $test_post = get_post( $test_post );