Changeset 53882

Timestamp:

08/11/2022 06:22:59 PM (2 years ago)

Author:

johnbillion

Message:

Application Passwords: Allow a Super Admin to set an application password on a site they're not a member of.

This removes the requirement that a Super Admin must be a member of the current site when they attempt to set an application password within the admin area of an individual site on the network.

Props TimothyBlynJacobs, ilovecats7, johnbillion, georgestephanis, johnjamesjacoby

Fixes #53224

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-application-passwords-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php

@@ -720 +720 @@
         }
 
-        if ( is_multisite() && ! is_user_member_of_blog( $user->ID ) ) {
+        if ( is_multisite() && ! user_can( $user->ID, 'manage_sites' ) && ! is_user_member_of_blog( $user->ID ) ) {
             return $error;
         }

trunk/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php

@@ -408 +408 @@
         $response = rest_do_request( $request );
         $this->assertErrorResponse( 'rest_user_invalid_id', $response, 404 );
+    }
+
+    /**
+     * @ticket 53224
+     * @group ms-required
+     */
+    public function test_create_item_for_super_admin_on_site_where_they_are_not_a_member() {
+        wp_set_current_user( self::$admin );
+
+        // Create a site where the Super Admin is not a member.
+        $blog_id = self::factory()->blog->create(
+            array(
+                'user_id' => self::$subscriber_id,
+            )
+        );
+
+        switch_to_blog( $blog_id );
+
+        $request = new WP_REST_Request( 'POST', '/wp/v2/users/me/application-passwords' );
+        $request->set_body_params( array( 'name' => 'App' ) );
+        $response = rest_do_request( $request );
+
+        restore_current_blog();
+
+        $this->assertNotWPError( $response );
+        $this->assertSame( 201, $response->get_status() );
     }