Make WordPress Core

Changeset 56840 for branches/6.3


Ignore:
Timestamp:
10/12/2023 01:08:43 PM (6 months ago)
Author:
audrasjb
Message:

REST API: Limit search_columns for users without list_users.

Props Vortfu, jorbin, joehoyle, timothyblynjacobs, peterwilsoncc, ehtis.
Reviewed by jorbin, audrasjb.

Location:
branches/6.3
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • branches/6.3

  • branches/6.3/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

    r56195 r56840  
    319319
    320320        if ( ! empty( $prepared_args['search'] ) ) {
     321            if ( ! current_user_can( 'list_users' ) ) {
     322                $prepared_args['search_columns'] = array( 'ID', 'user_login', 'user_nicename', 'display_name' );
     323            }
    321324            $prepared_args['search'] = '*' . $prepared_args['search'] . '*';
    322325        }
  • branches/6.3/tests/phpunit/tests/rest-api/rest-users-controller.php

    r55457 r56840  
    691691        $this->assertCount( 1, $data );
    692692        $this->assertSame( $adam_id, $data[0]['id'] );
     693    }
     694
     695    public function test_get_items_search_fields() {
     696        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
     697        $request->set_param( 'search', 'yololololo' );
     698        $response = rest_get_server()->dispatch( $request );
     699        $this->assertCount( 0, $response->get_data() );
     700
     701        $yolo_id = self::factory()->user->create( array( 'user_email' => 'yololololo@example.localhost' ) );
     702
     703        wp_set_current_user( self::$user );
     704        $request = new WP_REST_Request( 'GET', '/wp/v2/users' );
     705        $request->set_param( 'search', 'yololololo' );
     706        $response = rest_get_server()->dispatch( $request );
     707        $this->assertCount( 1, $response->get_data() );
     708
     709        wp_set_current_user( self::$editor );
     710        $response = rest_get_server()->dispatch( $request );
     711        $this->assertCount( 0, $response->get_data() );
    693712    }
    694713
Note: See TracChangeset for help on using the changeset viewer.