Changeset 39843

Timestamp:

01/11/2017 02:13:48 PM (8 years ago)

Author:

aaroncampbell

Message:

REST API: Change which users are shown in the users endpoint.

Only show users that have authored a post of a post type that has show_in_rest set to true.

Props rachelbaker, jnylen0.
See #38878.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (9 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -250 +250 @@
 
         if ( ! current_user_can( 'list_users' ) ) {
-            $prepared_args['has_published_posts'] = true;
+            $prepared_args['has_published_posts'] = get_post_types( array( 'show_in_rest' => true ), 'names' );
         }
 

trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -14 +14 @@
     protected static $user;
     protected static $editor;
+    protected static $editor2;
+    protected static $secret_editor;
+    protected static $secret_editor2;
     protected static $site;
 
@@ -28 +31 @@
             'user_email' => 'editor@example.com',
         ) );
+        self::$editor2 = $factory->user->create( array(
+            'role'       => 'editor',
+            'user_email' => 'editor2@example.com',
+        ) );
+        self::$secret_editor = $factory->user->create( array(
+            'role'       => 'editor',
+            'user_email' => 'secret_editor@example.com',
+        ) );
+        self::$secret_editor2 = $factory->user->create( array(
+            'role'       => 'editor',
+            'user_email' => 'secret_editor2@example.com',
+        ) );
 
         if ( is_multisite() ) {
@@ -38 +53 @@
         self::delete_user( self::$user );
         self::delete_user( self::$editor );
+        self::delete_user( self::$editor2 );
+        self::delete_user( self::$secret_editor );
+        self::delete_user( self::$secret_editor2 );
 
         if ( is_multisite() ) {
@@ -49 +67 @@
     public function setUp() {
         parent::setUp();
+
+        register_post_type( 'rest_public', array( 'public' => true, 'show_in_rest' => true ) );
+        register_post_type( 'secret_public', array( 'public' => true, 'show_in_rest' => false ) );
+        register_post_type( 'secret_hidden', array( 'public' => false, 'show_in_rest' => false ) );
+        register_post_type( 'rest_hidden', array( 'public' => false, 'show_in_rest' => true ) );
+
         $this->endpoint = new WP_REST_Users_Controller();
     }
@@ -145 +169 @@
     }
 
-    public function test_get_items_unauthenticated_only_shows_public_users() {
-        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
-        $response = $this->server->dispatch( $request );
-
-        $this->assertEquals( array(), $response->get_data() );
-
-        $this->factory->post->create( array( 'post_author' => self::$editor ) );
-        $this->factory->post->create( array( 'post_author' => self::$user, 'post_status' => 'draft' ) );
+    public function test_get_items_unauthenticated_includes_authors_of_post_types_shown_in_rest() {
+        $created_posts = array();
+        $created_posts[] = $this->factory->post->create( array(
+            'post_author' => self::$user,
+            'post_status' => 'publish',
+        ) );
+        // Expose authors if show_in_rest is true, even if the post_type is not public.
+        $created_posts[] = $this->factory->post->create( array(
+            'post_type' => 'rest_hidden',
+            'post_author' => self::$editor,
+            'post_status' => 'publish',
+        ) );
+        $created_posts[] = $this->factory->post->create( array(
+            'post_type' => 'rest_public',
+            'post_author' => self::$editor2,
+            'post_status' => 'publish',
+        ) );
+        $created_posts[] = $this->factory->post->create( array(
+            'post_type' => 'rest_public',
+            'post_author' => self::$secret_editor,
+            'post_status' => 'draft',
+        ) );
 
         $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
@@ -158 +196 @@
         $users = $response->get_data();
 
+        $public_post_types = array_values( get_post_types( array( 'show_in_rest' => true ), 'names' ) );
+
         foreach ( $users as $user ) {
-            $this->assertTrue( count_user_posts( $user['id'] ) > 0 );
-
-            // Ensure we don't expose non-public data
+            $this->assertTrue( count_user_posts( $user['id'], $public_post_types ) > 0 );
+
+            // Ensure we don't expose non-public data.
             $this->assertArrayNotHasKey( 'capabilities', $user );
+            $this->assertArrayNotHasKey( 'registered_date', $user );
+            $this->assertArrayNotHasKey( 'first_name', $user );
+            $this->assertArrayNotHasKey( 'last_name', $user );
+            $this->assertArrayNotHasKey( 'nickname', $user );
+            $this->assertArrayNotHasKey( 'extra_capabilities', $user );
+            $this->assertArrayNotHasKey( 'username', $user );
             $this->assertArrayNotHasKey( 'email', $user );
             $this->assertArrayNotHasKey( 'roles', $user );
+            $this->assertArrayNotHasKey( 'locale', $user );
+        }
+
+        $this->assertTrue( in_array( self::$user, wp_list_pluck( $users, 'id' ), true ) );
+        $this->assertTrue( in_array( self::$editor, wp_list_pluck( $users, 'id' ), true ) );
+        $this->assertTrue( in_array( self::$editor2, wp_list_pluck( $users, 'id' ), true ) );
+
+        // Do not include authors of unpublished posts.
+        $this->assertFalse( in_array( self::$secret_editor, wp_list_pluck( $users, 'id' ), true ) );
+
+        foreach ( $created_posts as $post_id ) {
+            wp_delete_post( $post_id, true );
+        }
+    }
+
+    public function test_get_items_unauthenticated_does_not_include_authors_of_post_types_not_shown_in_rest() {
+        $created_posts = array();
+        $created_posts[] = $this->factory->post->create( array(
+            'post_type' => 'secret_hidden',
+            'post_author' => self::$secret_editor,
+            'post_status' => 'publish',
+        ) );
+        $created_posts[] = $this->factory->post->create( array(
+            'post_type' => 'secret_public',
+            'post_author' => self::$secret_editor2,
+            'post_status' => 'publish',
+        ) );
+
+        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
+        $response = $this->server->dispatch( $request );
+        $data = $response->get_data();
+
+        $this->assertFalse( in_array( self::$secret_editor, wp_list_pluck( $data, 'id' ), true ) );
+        $this->assertFalse( in_array( self::$secret_editor2, wp_list_pluck( $data, 'id' ), true ) );
+
+        foreach ( $created_posts as $post_id ) {
+            wp_delete_post( $post_id, true );
         }
     }
@@ -170 +253 @@
     public function test_get_items_pagination_headers() {
         wp_set_current_user( self::$user );
-        // Start of the index, including the three existing users
-        for ( $i = 0; $i < 47; $i++ ) {
+        // Start of the index, including the six existing users.
+        for ( $i = 0; $i < 44; $i++ ) {
             $this->factory->user->create( array(
                 'name'   => "User {$i}",
@@ -392 +475 @@
     public function test_get_items_offset() {
         wp_set_current_user( self::$user );
-        // 2 users created in __construct(), plus default user
+        // 5 users created in __construct(), plus default user.
         $this->factory->user->create();
         $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
         $request->set_param( 'offset', 1 );
         $response = $this->server->dispatch( $request );
-        $this->assertCount( 4, $response->get_data() );
+        $this->assertCount( 7, $response->get_data() );
         // 'offset' works with 'per_page'
         $request->set_param( 'per_page', 2 );
@@ -2084 +2167 @@
 
     public function tearDown() {
+        _unregister_post_type( 'rest_public' );
+        _unregister_post_type( 'secret_public' );
+        _unregister_post_type( 'secret_hidden' );
+        _unregister_post_type( 'rest_hidden' );
+
         parent::tearDown();
     }