Changeset 59901

Timestamp:

03/02/2025 11:33:56 PM (7 weeks ago)

Author:

peterwilsoncc

Message:

Users: Use editable_roles filter for multisite sub-sites.

Adds a check of the editable_roles filter when adding users to a multisite sub-site to ensure the role is permitted to be used on the network. If the role is blocked by the filter, attempting to add the role will trigger a wp_die() similar to attempting to add a user with the role on a single site install.

Props eartboard, hareesh-pillai, ideag, sukhendu2002, spacedmonkey, thomaswm.
Fixes #43251.

Location:

trunk

Files:

• src/wp-admin/includes/ms.php (modified) (1 diff)
• src/wp-admin/user-new.php (modified) (2 diffs)
• tests/phpunit/tests/multisite/wpmuValidateUserSignup.php (modified) (1 diff)

trunk/src/wp-admin/includes/ms.php

@@ -1173 +1173 @@
         '<p>' . __( '<a href="https://wordpress.org/support/forum/multisite/">Support forums</a>' ) . '</p>';
 }
+
+/**
+ * Stop execution if the role can not be assigned by the current user.
+ *
+ * @since 6.8.0
+ *
+ * @param string $role Role the user is attempting to assign.
+ */
+function wp_ensure_editable_role( $role ) {
+    $roles = get_editable_roles();
+    if ( ! isset( $roles[ $role ] ) ) {
+        wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );
+    }
+}

trunk/src/wp-admin/user-new.php

@@ -70 +70 @@
     } else {
         if ( isset( $_POST['noconfirmation'] ) && current_user_can( 'manage_network_users' ) ) {
+
+            wp_ensure_editable_role( $_REQUEST['role'] );
+
             $result = add_existing_user_to_blog(
                 array(
@@ -225 +228 @@
                 add_filter( 'wpmu_welcome_user_notification', '__return_false' ); // Disable welcome email.
             }
+
+            wp_ensure_editable_role( $_REQUEST['role'] );
 
             wpmu_signup_user(

trunk/tests/phpunit/tests/multisite/wpmuValidateUserSignup.php

@@ -221 +221 @@
             $this->assertContains( 'invalid_nonce', $valid['errors']->get_error_codes() );
         }
+
+        /**
+         * Ensure that wp_ensure_editable_role does not throw an exception when the role is editable.
+         *
+         * @ticket 43251
+         *
+         * @covers ::wp_ensure_editable_role
+         */
+        public function test_wp_ensure_editable_role_allows_editable_roles() {
+            $role = get_role( 'editor' );
+            $this->assertInstanceOf( 'WP_Role', $role, 'The editor role should exist.' );
+            $this->assertNull( wp_ensure_editable_role( 'editor' ), 'The editor role should be editable.' );
+        }
+
+        /**
+         * Ensure that wp_ensure_editable_role throws an exception for non-existent roles.
+         *
+         * @ticket 43251
+         *
+         * @covers ::wp_ensure_editable_role
+         */
+        public function test_wp_ensure_editable_role_does_not_allow_non_existent_role() {
+            $this->expectException( 'WPDieException' );
+            $role = get_role( 'non-existent-role' );
+            $this->assertNotInstanceOf( 'WP_Role', $role, 'The non-existent-role role should not exist.' );
+            wp_ensure_editable_role( 'non-existent-role' );
+        }
+
+        /**
+         * Ensure that wp_ensure_editable_role throws an exception for roles that are not editable.
+         *
+         * @ticket 43251
+         *
+         * @covers ::wp_ensure_editable_role
+         */
+        public function test_wp_ensure_editable_role_does_not_allow_uneditable_roles() {
+            add_filter(
+                'editable_roles',
+                function ( $roles ) {
+                    unset( $roles['editor'] );
+                    return $roles;
+                }
+            );
+            $this->expectException( 'WPDieException' );
+            $role = get_role( 'editor' );
+            $this->assertInstanceOf( 'WP_Role', $role, 'The editor role should exist.' );
+            wp_ensure_editable_role( 'editor' );
+        }
     }