Changeset 43085

Timestamp:

05/02/2018 01:07:00 AM (8 years ago)

Author:

iandunn

Message:

Privacy: Limit export and erasure to super admins on Multisite.

Multisite networks have a variety of use cases, and in many of them single-site administrators are not trusted to take actions that affect the whole network, require making decisions about legal compliance, etc. By default, those actions should require super admin capabilities. Plugins can be used to override that behavior if a particular site's use case calls for it.

Props allendav, jeremyfelt, iandunn.
Fixes #43919.

Location:

trunk

Files:

• src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)
• src/wp-admin/includes/user.php (modified) (3 diffs)
• src/wp-includes/capabilities.php (modified) (1 diff)
• tests/phpunit/tests/user/capabilities.php (modified) (2 diffs)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -4345 +4345 @@
         }
 
-        if ( ! current_user_can( 'manage_options' ) ) {
+        if ( ! current_user_can( 'export_others_personal_data' ) ) {
                 wp_send_json_error( __( 'Invalid request.' ) );
         }
@@ -4523 +4523 @@
         }
 
-        if ( ! current_user_can( 'delete_users' ) ) {
+        // Both capabilities are required to avoid confusion, see `_wp_personal_data_removal_page()`.
+        if ( ! current_user_can( 'erase_others_personal_data' ) || ! current_user_can( 'delete_users' ) ) {
                 wp_send_json_error( __( 'Invalid request.' ) );
         }

trunk/src/wp-admin/includes/user.php

@@ -786 +786 @@
  */
 function _wp_personal_data_export_page() {
-        if ( ! current_user_can( 'manage_options' ) ) {
-                wp_die( esc_html__( 'Sorry, you are not allowed to manage privacy on this site.' ) );
+        if ( ! current_user_can( 'export_others_personal_data' ) ) {
+                wp_die( __( 'Sorry, you are not allowed to export personal data on this site.' ) );
         }
 
@@ -851 +851 @@
  */
 function _wp_personal_data_removal_page() {
-        if ( ! current_user_can( 'delete_users' ) ) {
-                wp_die( esc_html__( 'Sorry, you are not allowed to manage privacy on this site.' ) );
+        /*
+         * Require both caps in order to make it explicitly clear that delegating
+         * erasure from network admins to single-site admins will give them the
+         * ability to affect global users, rather than being limited to the site
+         * that they administer.
+         */
+        if ( ! current_user_can( 'erase_others_personal_data' ) || ! current_user_can( 'delete_users' ) ) {
+                wp_die( __( 'Sorry, you are not allowed to erase data on this site.' ) );
         }
 
@@ -918 +924 @@
  */
 function _wp_privacy_hook_requests_page() {
-        add_submenu_page( 'tools.php', __( 'Export Personal Data' ), __( 'Export Personal Data' ), 'manage_options', 'export_personal_data', '_wp_personal_data_export_page' );
-        add_submenu_page( 'tools.php', __( 'Remove Personal Data' ), __( 'Remove Personal Data' ), 'manage_options', 'remove_personal_data', '_wp_personal_data_removal_page' );
+        add_submenu_page( 'tools.php', __( 'Export Personal Data' ), __( 'Export Personal Data' ), 'export_others_personal_data', 'export_personal_data', '_wp_personal_data_export_page' );
+        add_submenu_page( 'tools.php', __( 'Remove Personal Data' ), __( 'Remove Personal Data' ), 'erase_others_personal_data', 'remove_personal_data', '_wp_personal_data_removal_page' );
 }
 

trunk/src/wp-includes/capabilities.php

@@ -556 +556 @@
                         }
                         break;
+                case 'export_others_personal_data':
+                case 'erase_others_personal_data':
+                        $caps[] = is_multisite() ? 'manage_network' : 'manage_options';
+                        break;
                 default:
                         // Handle meta capabilities for custom post types.

trunk/tests/phpunit/tests/user/capabilities.php

@@ -238 +238 @@
                         'deactivate_plugins'     => array( 'administrator' ),
                         'upgrade_php'            => array( 'administrator' ),
+                        'export_others_personal_data' => array( 'administrator' ),
+                        'erase_others_personal_data'  => array( 'administrator' ),
 
                         'edit_categories'        => array( 'administrator', 'editor' ),
@@ -270 +272 @@
                         'deactivate_plugins'     => array(),
                         'upgrade_php'            => array(),
+                        'export_others_personal_data' => array( '' ),
+                        'erase_others_personal_data'  => array( '' ),
 
                         'customize'              => array( 'administrator' ),