Changeset 63526

Timestamp:

09/08/2026 08:41:22 AM (less than one hour ago)

Author:

oandregal

Message:

REST API: expose privacy policy page in settings endpoint.

Props oandregal, ntsekouras, joen.
Fixes #66045.

Location:

trunk

Files:

• src/wp-includes/default-filters.php (modified) (1 diff)
• src/wp-includes/option.php (modified) (2 diffs)
• src/wp-includes/rest-api.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-settings-controller.php (modified) (3 diffs)
• tests/qunit/fixtures/wp-api-generated.js (modified) (2 diffs)

trunk/src/wp-includes/default-filters.php

@@ -546 +546 @@
 add_action( 'rest_api_init', 'rest_api_default_filters', 10, 1 );
 add_action( 'rest_api_init', 'register_initial_settings', 10 );
+add_filter( 'rest_pre_update_setting', 'rest_restrict_privacy_policy_page_setting_update', 10, 2 );
 add_action( 'rest_api_init', 'create_initial_rest_routes', 99 );
 add_action( 'parse_request', 'rest_api_loaded' );

trunk/src/wp-includes/option.php

@@ -2740 +2740 @@
  * @since 4.7.0
  * @since 6.0.1 The `show_on_front`, `page_on_front`, and `page_for_posts` options were added.
+ * @since 7.2.0 The `wp_page_for_privacy_policy` option was registered, exposed as `page_for_privacy_policy`.
  */
 function register_initial_settings() {
@@ -2933 +2934 @@
 
         register_setting(
+                'reading',
+                'wp_page_for_privacy_policy',
+                array(
+                        'show_in_rest' => array(
+                                'name' => 'page_for_privacy_policy',
+                        ),
+                        'type'         => 'integer',
+                        'description'  => __( 'The ID of the page that should be displayed as the privacy policy page' ),
+                )
+        );
+
+        register_setting(
                 'discussion',
                 'default_ping_status',

trunk/src/wp-includes/rest-api.php

@@ -3448 +3448 @@
 }
 
+/**
+ * Prevents users without the `manage_privacy_options` capability from
+ * changing the privacy policy page through the REST API.
+ *
+ * The settings endpoint only checks `manage_options`. On multisite the
+ * `manage_privacy_options` capability maps to `manage_network`, so a site
+ * administrator can read the setting but must not change it, matching the
+ * Settings > Privacy screen.
+ *
+ * @since 7.2.0
+ *
+ * @param bool   $updated Whether the setting update has already been handled.
+ * @param string $name    Setting name (as shown in REST API responses).
+ * @return bool Whether to short-circuit the update.
+ */
+function rest_restrict_privacy_policy_page_setting_update( $updated, $name ) {
+        if ( 'page_for_privacy_policy' === $name && ! current_user_can( 'manage_privacy_options' ) ) {
+                return true;
+        }
+        return $updated;
+}
 
 /**

trunk/tests/phpunit/tests/rest-api/rest-settings-controller.php

@@ -58 +58 @@
                 }
 
+                remove_filter( 'map_meta_cap', array( $this, 'deny_manage_privacy_options' ), 10 );
+
                 parent::tear_down();
+        }
+
+        /**
+         * Maps `manage_privacy_options` to `do_not_allow`, as happens for a site
+         * administrator on multisite.
+         *
+         * @param string[] $caps Primitive capabilities required.
+         * @param string   $cap  Capability being checked.
+         * @return string[] Primitive capabilities required.
+         */
+        public function deny_manage_privacy_options( $caps, $cap ) {
+                if ( 'manage_privacy_options' === $cap ) {
+                        return array( 'do_not_allow' );
+                }
+                return $caps;
         }
 
@@ -117 +134 @@
                         'page_on_front',
                         'page_for_posts',
+                        'page_for_privacy_policy',
                         'default_ping_status',
                         'default_comment_status',
@@ -402 +420 @@
                 $this->assertSame( 'The new title!', $data['title'] );
                 $this->assertSame( get_option( 'blogname' ), $data['title'] );
+        }
+
+        public function test_update_item_privacy_policy_page() {
+                wp_set_current_user( self::$administrator );
+                if ( is_multisite() ) {
+                        grant_super_admin( self::$administrator );
+                }
+                $page_id = self::factory()->post->create( array( 'post_type' => 'page' ) );
+
+                $request = new WP_REST_Request( 'PUT', '/wp/v2/settings' );
+                $request->set_param( 'page_for_privacy_policy', $page_id );
+                $response = rest_get_server()->dispatch( $request );
+                $data     = $response->get_data();
+
+                $this->assertSame( 200, $response->get_status() );
+                $this->assertSame( $page_id, $data['page_for_privacy_policy'] );
+                $this->assertSame( $page_id, (int) get_option( 'wp_page_for_privacy_policy' ) );
+        }
+
+        public function test_update_item_privacy_policy_page_without_capability() {
+                wp_set_current_user( self::$administrator );
+                $page_id = self::factory()->post->create( array( 'post_type' => 'page' ) );
+                update_option( 'wp_page_for_privacy_policy', $page_id );
+                $other_page_id = self::factory()->post->create( array( 'post_type' => 'page' ) );
+                add_filter( 'map_meta_cap', array( $this, 'deny_manage_privacy_options' ), 10, 2 );
+
+                $request = new WP_REST_Request( 'PUT', '/wp/v2/settings' );
+                $request->set_param( 'page_for_privacy_policy', $other_page_id );
+                $response = rest_get_server()->dispatch( $request );
+                $data     = $response->get_data();
+
+                $this->assertSame( 200, $response->get_status() );
+                $this->assertSame( $page_id, $data['page_for_privacy_policy'], 'The response should still report the previous page.' );
+                $this->assertSame( $page_id, (int) get_option( 'wp_page_for_privacy_policy' ), 'The option should not change.' );
         }
 

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -11238 +11238 @@
                             "required": false
                         },
+                        "page_for_privacy_policy": {
+                            "title": "",
+                            "description": "The ID of the page that should be displayed as the privacy policy page",
+                            "type": "integer",
+                            "required": false
+                        },
                         "default_ping_status": {
                             "title": "",
@@ -14933 +14939 @@
     "page_on_front": 0,
     "page_for_posts": 0,
+    "page_for_privacy_policy": 0,
     "default_ping_status": "open",
     "default_comment_status": "open",