Changeset 40581

Timestamp:

05/07/2017 05:41:24 PM (9 years ago)

Author:

johnbillion

Message:

Users: Correct a permission check when showing the User item in the + New admin toolbar menu.

Props dlh
Fixes #39252

Location:

trunk

Files:

• src/wp-includes/admin-bar.php (modified) (1 diff)
• tests/phpunit/tests/adminbar.php (modified) (1 diff)

trunk/src/wp-includes/admin-bar.php

@@ -719 +719 @@
                 $actions['post-new.php?post_type=content'][1] = 'add-new-content';
 
-        if ( current_user_can( 'create_users' ) || current_user_can( 'promote_users' ) )
+        if ( current_user_can( 'create_users' ) || ( is_multisite() && current_user_can( 'promote_users' ) ) ) {
                 $actions[ 'user-new.php' ] = array( _x( 'User', 'add new from admin bar' ), 'new-user' );
+        }
 
         if ( ! $actions )

trunk/tests/phpunit/tests/adminbar.php

@@ -531 +531 @@
         }
 
+        public function map_meta_cap_grant_create_users( $caps, $cap ) {
+                if ( 'create_users' === $cap ) {
+                        $caps = array( 'exist' );
+                }
+
+                return $caps;
+        }
+
+        public function map_meta_cap_deny_create_users( $caps, $cap ) {
+                if ( 'create_users' === $cap ) {
+                        $caps = array( 'do_not_allow' );
+                }
+
+                return $caps;
+        }
+
+        public function map_meta_cap_grant_promote_users( $caps, $cap ) {
+                if ( 'promote_users' === $cap ) {
+                        $caps = array( 'exist' );
+                }
+
+                return $caps;
+        }
+
+        public function map_meta_cap_deny_promote_users( $caps, $cap ) {
+                if ( 'promote_users' === $cap ) {
+                        $caps = array( 'do_not_allow' );
+                }
+
+                return $caps;
+        }
+
+        /**
+         * @ticket 39252
+         */
+        public function test_new_user_link_exists_for_user_with_create_users() {
+                wp_set_current_user( self::$admin_id );
+
+                add_filter( 'map_meta_cap', array( $this, 'map_meta_cap_grant_create_users' ), 10, 2 );
+                add_filter( 'map_meta_cap', array( $this, 'map_meta_cap_deny_promote_users' ), 10, 2 );
+
+                $this->assertTrue( current_user_can( 'create_users' ) );
+                $this->assertFalse( current_user_can( 'promote_users' ) );
+
+                $wp_admin_bar = $this->get_standard_admin_bar();
+                $node         = $wp_admin_bar->get_node( 'new-user' );
+
+                // 'create_users' is sufficient in single- and multisite.
+                $this->assertNotEmpty( $node );
+        }
+
+        /**
+         * @ticket 39252
+         */
+        public function test_new_user_link_existence_for_user_with_promote_users() {
+                wp_set_current_user( self::$admin_id );
+
+                add_filter( 'map_meta_cap', array( $this, 'map_meta_cap_deny_create_users' ), 10, 2 );
+                add_filter( 'map_meta_cap', array( $this, 'map_meta_cap_grant_promote_users' ), 10, 2 );
+
+                $this->assertFalse( current_user_can( 'create_users' ) );
+                $this->assertTrue( current_user_can( 'promote_users' ) );
+
+                $wp_admin_bar = $this->get_standard_admin_bar();
+                $node         = $wp_admin_bar->get_node( 'new-user' );
+
+                if ( is_multisite() ) {
+                        $this->assertNotEmpty( $node );
+                } else {
+                        // 'promote_users' is insufficient in single-site.
+                        $this->assertNull( $node );
+                }
+        }
+
+        /**
+         * @ticket 39252
+         */
+        public function test_new_user_link_does_not_exist_for_user_without_create_or_promote_users() {
+                wp_set_current_user( self::$admin_id );
+
+                add_filter( 'map_meta_cap', array( $this, 'map_meta_cap_deny_create_users' ), 10, 2 );
+                add_filter( 'map_meta_cap', array( $this, 'map_meta_cap_deny_promote_users' ), 10, 2 );
+
+                $this->assertFalse( current_user_can( 'create_users' ) );
+                $this->assertFalse( current_user_can( 'promote_users' ) );
+
+                $wp_admin_bar = $this->get_standard_admin_bar();
+                $node         = $wp_admin_bar->get_node( 'new-user' );
+
+                $this->assertNull( $node );
+        }
+
         /**
          * @ticket 30937