Changeset 50114

Timestamp:

01/31/2021 07:02:30 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

App Passwords: Introduce fine grained capabilities.

Previously, all permission checks for using app passwords were implemented using edit_user. This commit introduces a series of more fine grained meta capabilities that should be used instead: create_app_password, list_app_passwords, read_app_password, edit_app_password, delete_app_password and delete_app_passwords. These capabilities all map to edit_user by default, but may now be customized by developers.

Props johnbillion, TimothyBlynJacobs.
Fixes #51703.

Location:

trunk

Files:

• src/wp-includes/capabilities.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php (modified) (8 diffs)
• tests/phpunit/tests/rest-api/rest-application-passwords-controller.php (modified) (6 diffs)
• tests/phpunit/tests/user/capabilities.php (modified) (1 diff)

trunk/src/wp-includes/capabilities.php

@@ -593 +593 @@
             $caps[] = is_multisite() ? 'manage_network' : 'manage_options';
             break;
+        case 'create_app_password':
+        case 'list_app_passwords':
+        case 'read_app_password':
+        case 'edit_app_password':
+        case 'delete_app_passwords':
+        case 'delete_app_password':
+            $caps = map_meta_cap( 'edit_user', $user_id, $args[0] );
+            break;
         default:
             // Handle meta capabilities for custom post types.

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php

@@ -111 +111 @@
      */
     public function get_items_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'list_app_passwords', $user->ID ) ) {
+            return new WP_Error(
+                'rest_cannot_list_application_passwords',
+                __( 'Sorry, you are not allowed to list application passwords for this user.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -150 +164 @@
      */
     public function get_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'read_app_password', $user->ID, $request['uuid'] ) ) {
+            return new WP_Error(
+                'rest_cannot_read_application_password',
+                __( 'Sorry, you are not allowed to read this application password.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -180 +208 @@
      */
     public function create_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'create_app_password', $user->ID ) ) {
+            return new WP_Error(
+                'rest_cannot_create_application_passwords',
+                __( 'Sorry, you are not allowed to create application passwords for this user.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -249 +291 @@
      */
     public function update_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'edit_app_password', $user->ID, $request['uuid'] ) ) {
+            return new WP_Error(
+                'rest_cannot_edit_application_password',
+                __( 'Sorry, you are not allowed to edit this application password.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -309 +365 @@
      */
     public function delete_items_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'delete_app_passwords', $user->ID ) ) {
+            return new WP_Error(
+                'rest_cannot_delete_application_passwords',
+                __( 'Sorry, you are not allowed to delete application passwords for this user.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -350 +420 @@
      */
     public function delete_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'delete_app_password', $user->ID, $request['uuid'] ) ) {
+            return new WP_Error(
+                'rest_cannot_delete_application_password',
+                __( 'Sorry, you are not allowed to delete this application password.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -458 +542 @@
      *
      * @since 5.6.0
+     * @deprecated 5.7.0 Use `edit_user` directly or one of the specific meta capabilities introduced in 5.7.0.
      *
      * @param WP_REST_Request $request
@@ -463 +548 @@
      */
     protected function do_permissions_check( $request ) {
+        _deprecated_function( __METHOD__, '5.7.0' );
+
         $user = $this->get_user( $request );
 

trunk/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php

@@ -191 +191 @@
 
         $response = rest_do_request( sprintf( '/wp/v2/users/%d/application-passwords', self::$admin ) );
-        $this->assertErrorResponse( 'rest_cannot_manage_application_passwords', $response, 403 );
+        $this->assertErrorResponse( 'rest_cannot_list_application_passwords', $response, 403 );
     }
 
@@ -273 +273 @@
         $uuid     = $item['uuid'];
         $response = rest_do_request( sprintf( '/wp/v2/users/%d/application-passwords/%s', self::$admin, $uuid ) );
-        $this->assertErrorResponse( 'rest_cannot_manage_application_passwords', $response, 403 );
+        $this->assertErrorResponse( 'rest_cannot_read_application_password', $response, 403 );
     }
 
@@ -395 +395 @@
         $request->set_body_params( array( 'name' => 'App' ) );
         $response = rest_do_request( $request );
-        $this->assertErrorResponse( 'rest_cannot_manage_application_passwords', $response, 403 );
+        $this->assertErrorResponse( 'rest_cannot_create_application_passwords', $response, 403 );
     }
 
@@ -501 +501 @@
         $request->set_body_params( array( 'name' => 'New App' ) );
         $response = rest_do_request( $request );
-        $this->assertErrorResponse( 'rest_cannot_manage_application_passwords', $response, 403 );
+        $this->assertErrorResponse( 'rest_cannot_edit_application_password', $response, 403 );
     }
 
@@ -644 +644 @@
         $request  = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d/application-passwords/%s', self::$admin, $uuid ) );
         $response = rest_do_request( $request );
-        $this->assertErrorResponse( 'rest_cannot_manage_application_passwords', $response, 403 );
+        $this->assertErrorResponse( 'rest_cannot_delete_application_password', $response, 403 );
     }
 
@@ -748 +748 @@
         $request  = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d/application-passwords', self::$admin ) );
         $response = rest_do_request( $request );
-        $this->assertErrorResponse( 'rest_cannot_manage_application_passwords', $response, 403 );
+        $this->assertErrorResponse( 'rest_cannot_delete_application_passwords', $response, 403 );
     }
 

trunk/tests/phpunit/tests/user/capabilities.php

@@ -523 +523 @@
             $expected['edit_user_meta'],
             $expected['delete_user_meta'],
-            $expected['add_user_meta']
+            $expected['add_user_meta'],
+            $expected['create_app_password'],
+            $expected['list_app_passwords'],
+            $expected['read_app_password'],
+            $expected['edit_app_password'],
+            $expected['delete_app_passwords'],
+            $expected['delete_app_password']
         );