Changeset 41624 for trunk/src/wp-includes/class-wp-user.php

Timestamp:

09/27/2017 09:09:11 PM (7 years ago)

Author:

flixos90

Message:

Multisite: Initialize a user's roles correctly when setting them up for a different site.

While it has always been possible to initialize a user's roles and capabilities for another site than the current one in a multisite, the actual roles available were not switched prior to this change, possibly causing invalid roles to show up or actually valid capabilities not being available.

In order to fix this bug in a clean way, relevant parts of the WP_User class have been refactored. The ID of the site for which capabilities are currently initialized are now stored in a private property WP_User::$site_id. The WP_User::for_blog( $blog_id ) and WP_User::_init_caps( $cap_key ) methods have been deprecated in favor of WP_User::for_site( $site_id ). In addition, a new method WP_User::get_site_id() has been introduced to retrieve the site ID for which the user's capabilities are currently initialized.

Props ryanduff, jeremyfelt, flixos90.
Fixes #36961.

File:

• trunk/src/wp-includes/class-wp-user.php (modified) (13 diffs)

trunk/src/wp-includes/class-wp-user.php

@@ -94 +94 @@
 
     /**
+     * The site ID the capabilities of this user are initialized for.
+     *
+     * @since 4.9.0
+     * @var int
+     */
+    private $site_id = 0;
+
+    /**
      * @static
      * @since 3.3.0
@@ -111 +119 @@
      * @param int|string|stdClass|WP_User $id User's ID, a WP_User object, or a user object from the DB.
      * @param string $name Optional. User's username
-     * @param int $blog_id Optional Site ID, defaults to current site.
-     */
-    public function __construct( $id = 0, $name = '', $blog_id = '' ) {
+     * @param int $site_id Optional Site ID, defaults to current site.
+     */
+    public function __construct( $id = 0, $name = '', $site_id = '' ) {
         if ( ! isset( self::$back_compat_keys ) ) {
             $prefix = $GLOBALS['wpdb']->prefix;
@@ -127 +135 @@
 
         if ( $id instanceof WP_User ) {
-            $this->init( $id->data, $blog_id );
+            $this->init( $id->data, $site_id );
             return;
         } elseif ( is_object( $id ) ) {
-            $this->init( $id, $blog_id );
+            $this->init( $id, $site_id );
             return;
         }
@@ -146 +154 @@
 
         if ( $data ) {
-            $this->init( $data, $blog_id );
+            $this->init( $data, $site_id );
         } else {
             $this->data = new stdClass;
@@ -158 +166 @@
      *
      * @param object $data    User DB row object.
-     * @param int    $blog_id Optional. The site ID to initialize for.
-     */
-    public function init( $data, $blog_id = '' ) {
+     * @param int    $site_id Optional. The site ID to initialize for.
+     */
+    public function init( $data, $site_id = '' ) {
         $this->data = $data;
         $this->ID = (int) $data->ID;
 
-        $this->for_blog( $blog_id );
+        $this->for_site( $site_id );
     }
 
@@ -242 +250 @@
 
     /**
-     * Makes private/protected methods readable for backward compatibility.
-     *
-     * @since 4.3.0
-     *
-     * @param callable $name      Method to call.
-     * @param array    $arguments Arguments to pass when calling.
-     * @return mixed|false Return value of the callback, false otherwise.
-     */
-    public function __call( $name, $arguments ) {
-        if ( '_init_caps' === $name ) {
-            return call_user_func_array( array( $this, $name ), $arguments );
-        }
-        return false;
-    }
-
-    /**
      * Magic method for checking the existence of a certain custom field.
      *
@@ -426 +418 @@
 
     /**
+     * Makes private/protected methods readable for backward compatibility.
+     *
+     * @since 4.3.0
+     *
+     * @param callable $name      Method to call.
+     * @param array    $arguments Arguments to pass when calling.
+     * @return mixed|false Return value of the callback, false otherwise.
+     */
+    public function __call( $name, $arguments ) {
+        if ( '_init_caps' === $name ) {
+            return call_user_func_array( array( $this, $name ), $arguments );
+        }
+        return false;
+    }
+
+    /**
      * Set up capability object properties.
      *
@@ -434 +442 @@
      *
      * @since 2.1.0
+     * @deprecated 4.9.0 Use WP_User::for_site()
      *
      * @global wpdb $wpdb WordPress database abstraction object.
@@ -442 +451 @@
         global $wpdb;
 
-        if ( empty($cap_key) )
-            $this->cap_key = $wpdb->get_blog_prefix() . 'capabilities';
-        else
+        _deprecated_function( __METHOD__, '4.9.0', 'WP_User::for_site()' );
+
+        if ( empty( $cap_key ) ) {
+            $this->cap_key = $wpdb->get_blog_prefix( $this->site_id ) . 'capabilities';
+        } else {
             $this->cap_key = $cap_key;
-
-        $this->caps = get_user_meta( $this->ID, $this->cap_key, true );
-
-        if ( ! is_array( $this->caps ) )
-            $this->caps = array();
+        }
+
+        $this->caps = $this->get_caps_data();
 
         $this->get_role_caps();
@@ -468 +477 @@
      */
     public function get_role_caps() {
+        $switch_site = false;
+        if ( is_multisite() && $this->site_id != get_current_blog_id() ) {
+            $switch_site = true;
+
+            switch_to_blog( $this->site_id );
+        }
+
         $wp_roles = wp_roles();
 
@@ -481 +497 @@
         }
         $this->allcaps = array_merge( (array) $this->allcaps, (array) $this->caps );
+
+        if ( $switch_site ) {
+            restore_current_blog();
+        }
 
         return $this->allcaps;
@@ -755 +775 @@
      *
      * @since 3.0.0
+     * @deprecated 4.9.0 Use WP_User::for_site()
      *
      * @global wpdb $wpdb WordPress database abstraction object.
@@ -761 +782 @@
      */
     public function for_blog( $blog_id = '' ) {
+        _deprecated_function( __METHOD__, '4.9.0', 'WP_User::for_site()' );
+
+        $this->for_site( $blog_id );
+    }
+
+    /**
+     * Sets the site to operate on. Defaults to the current site.
+     *
+     * @since 4.9.0
+     *
+     * @global wpdb $wpdb WordPress database abstraction object.
+     *
+     * @param int $site_id Site ID to initialize user capabilities for. Default is the current site.
+     */
+    public function for_site( $site_id = '' ) {
         global $wpdb;
-        if ( ! empty( $blog_id ) )
-            $cap_key = $wpdb->get_blog_prefix( $blog_id ) . 'capabilities';
-        else
-            $cap_key = '';
-        $this->_init_caps( $cap_key );
+
+        if ( ! empty( $site_id ) ) {
+            $this->site_id = absint( $site_id );
+        } else {
+            $this->site_id = get_current_blog_id();
+        }
+
+        $this->cap_key = $wpdb->get_blog_prefix( $this->site_id ) . 'capabilities';
+
+        $this->caps = $this->get_caps_data();
+
+        $this->get_role_caps();
+    }
+
+    /**
+     * Gets the ID of the site for which the user's capabilities are currently initialized.
+     *
+     * @since 4.9.0
+     *
+     * @return int Site ID.
+     */
+    public function get_site_id() {
+        return $this->site_id;
+    }
+
+    /**
+     * Gets the available user capabilities data.
+     *
+     * @since 4.9.0
+     *
+     * @return array User capabilities array.
+     */
+    private function get_caps_data() {
+        $caps = get_user_meta( $this->ID, $this->cap_key, true );
+
+        if ( ! is_array( $caps ) ) {
+            return array();
+        }
+
+        return $caps;
     }
 }