WordPress.org
Get WordPress

Make WordPress Core


Ignore:
Timestamp:
04/25/2018 01:05:48 PM (8 years ago)
Author:
pento
Message:

REST API: Add who=authors as a query parameter for GET wp/v2/users.

Any WordPress user who can edit_posts of a post type with show_in_rest=true can query for authors. This maps to current WordPress behavior where a WordPress user who can view the Manage Posts view for a post type can see any WordPress user assigned to a post (whether published or draft).

This implementation, over restricting who=authors to users with list_users, gives us future flexibility in displaying lists of posts. It still respects more restrictive permissions for context=edit.

Props danielbachhuber.
Fixes #42202.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

    r42724 r43001  
    1515    protected static $editor;
    1616    protected static $draft_editor;
     17    protected static $subscriber;
    1718    protected static $authors = array();
    1819    protected static $posts   = array();
    … …  
    4142                'role'       => 'editor',
    4243                'user_email' => 'draft-editor@example.com',
     44            )
     45        );
     46        self::$subscriber    = $factory->user->create(
     47            array(
     48                'role'         => 'subscriber',
     49                'display_name' => 'subscriber',
     50                'user_email'   => 'subscriber@example.com',
    4351            )
    4452        );
    … …  
    167175                'search',
    168176                'slug',
     177                'who',
    169178            ), $keys
    170179        );
    … …  
    281290        $response = rest_get_server()->dispatch( $request );
    282291        $headers  = $response->get_headers();
    283         $this->assertEquals( 53, $headers['X-WP-Total'] );
     292        $this->assertEquals( 54, $headers['X-WP-Total'] );
    284293        $this->assertEquals( 6, $headers['X-WP-TotalPages'] );
    285294        $next_link = add_query_arg(
    … …  
    300309        $response = rest_get_server()->dispatch( $request );
    301310        $headers  = $response->get_headers();
    302         $this->assertEquals( 54, $headers['X-WP-Total'] );
     311        $this->assertEquals( 55, $headers['X-WP-Total'] );
    303312        $this->assertEquals( 6, $headers['X-WP-TotalPages'] );
    304313        $prev_link = add_query_arg(
    … …  
    319328        $response = rest_get_server()->dispatch( $request );
    320329        $headers  = $response->get_headers();
    321         $this->assertEquals( 54, $headers['X-WP-Total'] );
     330        $this->assertEquals( 55, $headers['X-WP-Total'] );
    322331        $this->assertEquals( 6, $headers['X-WP-TotalPages'] );
    323332        $prev_link = add_query_arg(
    … …  
    333342        $response = rest_get_server()->dispatch( $request );
    334343        $headers  = $response->get_headers();
    335         $this->assertEquals( 54, $headers['X-WP-Total'] );
     344        $this->assertEquals( 55, $headers['X-WP-Total'] );
    336345        $this->assertEquals( 6, $headers['X-WP-TotalPages'] );
    337346        $prev_link = add_query_arg(
    … …  
    526535    public function test_get_items_offset() {
    527536        wp_set_current_user( self::$user );
    528         // 7 users created in wpSetUpBeforeClass(), plus default user.
     537        // 9 users created in wpSetUpBeforeClass(), plus default user.
    529538        $this->factory->user->create();
    530539        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
    531540        $request->set_param( 'offset', 1 );
    532541        $response = rest_get_server()->dispatch( $request );
    533         $this->assertCount( 9, $response->get_data() );
     542        $this->assertCount( 10, $response->get_data() );
    534543        // 'offset' works with 'per_page'
    535544        $request->set_param( 'per_page', 2 );
    … …  
    745754        $response = rest_get_server()->dispatch( $request );
    746755        $data     = $response->get_data();
    747         $this->assertEquals( 2, count( $data ) );
    748         $this->assertEquals( $tango, $data[0]['id'] );
    749         $this->assertEquals( $yolo, $data[1]['id'] );
     756        $this->assertEquals( 3, count( $data ) );
     757        $this->assertEquals( $tango, $data[1]['id'] );
     758        $this->assertEquals( $yolo, $data[2]['id'] );
    750759        $request->set_param( 'roles', 'author' );
    751760        $response = rest_get_server()->dispatch( $request );
    … …  
    783792        $this->assertEquals( 0, count( $data ) );
    784793        $this->assertEquals( array(), $data );
     794    }
     795
     796    public function test_get_items_who_author_query() {
     797        wp_set_current_user( self::$superadmin );
     798        // First request should include subscriber in the set.
     799        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
     800        $request->set_param( 'search', 'subscriber' );
     801        $response = rest_get_server()->dispatch( $request );
     802        $this->assertEquals( 200, $response->get_status() );
     803        $this->assertCount( 1, $response->get_data() );
     804        // Second request should exclude subscriber.
     805        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
     806        $request->set_param( 'who', 'authors' );
     807        $request->set_param( 'search', 'subscriber' );
     808        $response = rest_get_server()->dispatch( $request );
     809        $this->assertEquals( 200, $response->get_status() );
     810        $this->assertCount( 0, $response->get_data() );
     811    }
     812
     813    public function test_get_items_who_invalid_query() {
     814        wp_set_current_user( self::$user );
     815        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
     816        $request->set_param( 'who', 'editor' );
     817        $response = rest_get_server()->dispatch( $request );
     818        $this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
     819    }
     820
     821    /**
     822     * Any user with 'edit_posts' on a show_in_rest post type
     823     * can view authors. Others (e.g. subscribers) cannot.
     824     */
     825    public function test_get_items_who_unauthorized_query() {
     826        wp_set_current_user( self::$subscriber );
     827        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
     828        $request->set_param( 'who', 'authors' );
     829        $response = rest_get_server()->dispatch( $request );
     830        $this->assertErrorResponse( 'rest_forbidden_who', $response, 403 );
    785831    }
    786832
Note: See TracChangeset for help on using the changeset viewer.