Changeset 60491

Timestamp:

07/21/2025 05:58:11 PM (13 months ago)

Author:

SergeyBiryukov

Message:

Role/Capability: Ensure that logged-out users cannot edit themselves.

Follow-up to [3846], [6697], [14189], [21152].

Props dd32, peterwilsoncc, johnbillion, mukesh27, swissspidy, SergeyBiryukov.
Fixes #63684.

Location:

trunk

Files:

• src/wp-includes/capabilities.php (modified) (1 diff)
• tests/phpunit/tests/user/capabilities.php (modified) (1 diff)

trunk/src/wp-includes/capabilities.php

@@ -61 +61 @@
                 case 'edit_user':
                 case 'edit_users':
+                        // Non-existent users can't edit users, not even themselves.
+                        if ( $user_id < 1 ) {
+                                $caps[] = 'do_not_allow';
+                                break;
+                        }
+
                         // Allow user to edit themselves.
                         if ( 'edit_user' === $cap && isset( $args[0] ) && $user_id === (int) $args[0] ) {

trunk/tests/phpunit/tests/user/capabilities.php

@@ -1831 +1831 @@
         }
 
-        public function test_user_can_edit_self() {
-                foreach ( self::$users as $role => $user ) {
-                        wp_set_current_user( $user->ID );
-                        $this->assertTrue( current_user_can( 'edit_user', $user->ID ), "User with role {$role} should have the capability to edit their own profile" );
-                }
+        /**
+         * Test if a user can edit their own profile based on their role.
+         *
+         * @ticket 63684
+         *
+         * @dataProvider data_user_can_edit_self
+         *
+         * @param string $role          The role of the user.
+         * @param bool   $can_edit_self Whether the user can edit their own profile.
+         */
+        public function test_user_can_edit_self( $role, $can_edit_self = true ) {
+                $user = self::$users[ $role ];
+                wp_set_current_user( $user->ID );
+
+                if ( $can_edit_self ) {
+                        $this->assertTrue(
+                                current_user_can( 'edit_user', $user->ID ),
+                                "User with role '{$role}' should have the capability to edit their own profile"
+                        );
+                } else {
+                        $this->assertFalse(
+                                current_user_can( 'edit_user', $user->ID ),
+                                "User with role '{$role}' should not have the capability to edit their own profile"
+                        );
+                }
+        }
+
+        /**
+         * Data provider for test_user_can_edit_self.
+         *
+         * @return array[] Data provider.
+         */
+        public static function data_user_can_edit_self() {
+                return array(
+                        'anonymous'     => array( 'anonymous', false ),
+                        'administrator' => array( 'administrator', true ),
+                        'editor'        => array( 'editor', true ),
+                        'author'        => array( 'author', true ),
+                        'contributor'   => array( 'contributor', true ),
+                        'subscriber'    => array( 'subscriber', true ),
+                );
         }