Changeset 41226 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

Timestamp:

08/03/2017 09:58:50 PM (8 years ago)

Author:

flixos90

Message:

REST API: Allow site administrators to edit user roles in multisite.

While site administrators cannot generally edit users in multisite, they have always been able to change the roles of users on their site. In the REST API however, this has not been possible so far. This changeset brings parity with how it is handled in the administration panel: A REST request to edit only a user's roles succeeds correctly, while a REST request to edit any further details of a user fails.

Props jnylen0.
Fixes #40263.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -562 +562 @@
         }
 
+        if ( ! empty( $request['roles'] ) ) {
+            if ( ! current_user_can( 'promote_user', $user->ID ) ) {
+                return new WP_Error( 'rest_cannot_edit_roles', __( 'Sorry, you are not allowed to edit roles of this user.' ), array( 'status' => rest_authorization_required_code() ) );
+            }
+
+            $request_params = array_keys( $request->get_params() );
+            sort( $request_params );
+            // If only 'id' and 'roles' are specified (we are only trying to
+            // edit roles), then only the 'promote_user' cap is required.
+            if ( $request_params === array( 'id', 'roles' ) ) {
+                return true;
+            }
+        }
+
         if ( ! current_user_can( 'edit_user', $user->ID ) ) {
             return new WP_Error( 'rest_cannot_edit', __( 'Sorry, you are not allowed to edit this user.' ), array( 'status' => rest_authorization_required_code() ) );
-        }
-
-        if ( ! empty( $request['roles'] ) && ! current_user_can( 'edit_users' ) ) {
-            return new WP_Error( 'rest_cannot_edit_roles', __( 'Sorry, you are not allowed to edit roles of this user.' ), array( 'status' => rest_authorization_required_code() ) );
         }