Changeset 64687

Timestamp:

10/23/2026 07:43:15 AM (less than one hour ago)

Author:

gziolo

Message:

Abilities API: Align environment info permissions with Site Health

Require view_site_health_checks for core/get-environment-info
instead of manage_options. Add regression tests.

Props gziolo, jorgefilipecosta, jonsurrell.
Fixes #66369.

Location:

trunk

Files:

• src/wp-includes/abilities.php (modified) (1 diff)
• tests/phpunit/tests/abilities-api/wpRegisterCoreAbilities.php (modified) (4 diffs)

trunk/src/wp-includes/abilities.php

@@ -359 +359 @@
                                 return array_intersect_key( $all, array_flip( $requested_fields ) );
                         },
-                        'required_capabilities' => array( 'manage_options' ),
+                        'required_capabilities' => array( 'view_site_health_checks' ),
                         'meta'                  => array(
                                 'annotations' => array(

trunk/tests/phpunit/tests/abilities-api/wpRegisterCoreAbilities.php

@@ -302 +302 @@
          */
         public function test_core_get_environment_info_executes(): void {
-                // Requires manage_options.
+                // Requires access to Site Health diagnostics.
                 $admin_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
-                wp_set_current_user( $admin_id );
+                $user     = wp_set_current_user( $admin_id );
+                $user->add_cap( 'view_site_health_checks' );
 
                 $ability      = wp_get_ability( 'core/get-environment-info' );
@@ -319 +320 @@
 
         /**
+         * Tests that managing site options does not grant access to environment information.
+         *
+         * @ticket 66369
+         */
+        public function test_core_get_environment_info_requires_site_health_access(): void {
+                $user_id = self::factory()->user->create( array( 'role' => 'subscriber' ) );
+                $user    = wp_set_current_user( $user_id );
+                $user->add_cap( 'manage_options' );
+
+                $this->assertTrue( current_user_can( 'manage_options' ) );
+                $this->assertFalse( current_user_can( 'view_site_health_checks' ) );
+
+                $result = wp_get_ability( 'core/get-environment-info' )->execute();
+
+                $this->assertWPError( $result );
+                $this->assertSame( 'ability_invalid_permissions', $result->get_error_code() );
+        }
+
+        /**
+         * Tests that Site Health access can be delegated without granting site management access.
+         *
+         * @ticket 66369
+         */
+        public function test_core_get_environment_info_allows_delegated_site_health_access(): void {
+                $user_id = self::factory()->user->create( array( 'role' => 'subscriber' ) );
+                $user    = wp_set_current_user( $user_id );
+                $user->add_cap( 'view_site_health_checks' );
+
+                $this->assertFalse( current_user_can( 'manage_options' ) );
+
+                $result = wp_get_ability( 'core/get-environment-info' )->execute();
+
+                $this->assertIsArray( $result );
+        }
+
+        /**
+         * Tests that multisite site administrators cannot access environment information.
+         *
+         * @ticket 66369
+         * @group ms-required
+         */
+        public function test_core_get_environment_info_denies_multisite_site_administrator(): void {
+                $admin_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
+                wp_set_current_user( $admin_id );
+
+                $this->assertFalse( is_super_admin() );
+                $this->assertTrue( current_user_can( 'manage_options' ) );
+                $this->assertFalse( current_user_can( 'view_site_health_checks' ) );
+
+                $result = wp_get_ability( 'core/get-environment-info' )->execute();
+
+                $this->assertWPError( $result );
+                $this->assertSame( 'ability_invalid_permissions', $result->get_error_code() );
+        }
+
+        /**
          * Tests that the `core/get-environment-info` ability is registered with the expected schema.
          *
@@ -357 +414 @@
         public function test_core_get_environment_info_filters_fields(): void {
                 $admin_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
-                wp_set_current_user( $admin_id );
+                $user     = wp_set_current_user( $admin_id );
+                $user->add_cap( 'view_site_health_checks' );
 
                 $ability = wp_get_ability( 'core/get-environment-info' );
@@ -382 +440 @@
         public function test_core_get_environment_info_rejects_invalid_fields(): void {
                 $admin_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
-                wp_set_current_user( $admin_id );
+                $user     = wp_set_current_user( $admin_id );
+                $user->add_cap( 'view_site_health_checks' );
 
                 $ability = wp_get_ability( 'core/get-environment-info' );