Changeset 60839 for branches/4.7/tests/phpunit/tests/rest-api/rest-users-controller.php

Timestamp:

09/30/2025 05:06:42 PM (9 months ago)

Author:

desrosj

Message:

Grouped backports for the 4.7 branch.

• REST API: Increase the specificity of capability checks for collections when the edit context is in use.
• Menus: Prevent HTML in menu item titles from being rendered unexpectedly.

Merges [60814], [60815], [60816] to the 4.7 branch.

Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (2 diffs)

branches/4.7/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -819 +819 @@
         $request->set_param( 'context', 'edit' );
         $response = $this->server->dispatch( $request );
-        $this->assertErrorResponse( 'rest_user_cannot_view', $response, 401 );
+        $this->assertErrorResponse( 'rest_forbidden_context', $response, 401 );
     }
 
@@ -2396 +2396 @@
     }
 
+    /**
+     * Callback for map_meta_cap filter to disallow edit_user capability
+     *
+     * @param array  $caps Required capabilities.
+     * @param string $cap  Capability being checked.
+     * @return array Modified capabilities.
+     */
+    public function disallow_edit_user_cap( $caps, $cap ) {
+        if ( 'edit_user' === $cap ) {
+            return array( 'do_not_allow' );
+        }
+
+        return $caps;
+    }
+
+    /**
+     * Callback for map_meta_cap filter to allow edit_user capability
+     *
+     * @param array  $caps Required capabilities.
+     * @param string $cap  Capability being checked.
+     * @return array Modified capabilities.
+     */
+    public function allow_edit_user_cap( $caps, $cap ) {
+        if ( 'edit_user' === $cap ) {
+            return array();
+        }
+
+        return $caps;
+    }
+
     protected function allow_user_to_manage_multisite() {
         wp_set_current_user( self::$user );