Changeset 56833

Timestamp:

10/12/2023 12:28:57 PM (3 years ago)

Author:

audrasjb

Message:

REST API: Limit search_columns for users without list_users.

Props Vortfu, jorbin, joehoyle, timothyblynjacobs, peterwilsoncc, ehtis.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -319 +319 @@
 
                 if ( ! empty( $prepared_args['search'] ) ) {
+                        if ( ! current_user_can( 'list_users' ) ) {
+                                $prepared_args['search_columns'] = array( 'ID', 'user_login', 'user_nicename', 'display_name' );
+                        }
                         $prepared_args['search'] = '*' . $prepared_args['search'] . '*';
                 }

trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -690 +690 @@
                 $this->assertCount( 1, $data );
                 $this->assertSame( $adam_id, $data[0]['id'] );
+        }
+
+        public function test_get_items_search_fields() {
+                $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
+                $request->set_param( 'search', 'yololololo' );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertCount( 0, $response->get_data() );
+
+                $yolo_id = self::factory()->user->create( array( 'user_email' => 'yololololo@example.localhost' ) );
+
+                wp_set_current_user( self::$user );
+                $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
+                $request->set_param( 'search', 'yololololo' );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertCount( 1, $response->get_data() );
+
+                wp_set_current_user( self::$editor );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertCount( 0, $response->get_data() );
         }