WordPress.org

Make WordPress Core

Opened 2 years ago

Closed 2 years ago

Last modified 2 years ago

#38961 closed defect (bug) (invalid)

REST API: User with `promote_users` cap can't add existing users to a site

Reported by: ocean90 Owned by: jeremyfelt
Milestone: Priority: normal
Severity: normal Version: 4.7
Component: REST API Keywords: has-unit-tests needs-patch
Focuses: multisite Cc:

Description

Adding an existing user to a site should be done by performing a PUT request to the user resource on the other site, see ticket:38526:7. This works if the current user can edit users.

But core also allows users with the promote_users capability to add existing users:

Attachments (1)

38961.patch (1.6 KB) - added by ocean90 2 years ago.

Download all attachments as: .zip

Change History (9)

@ocean90
2 years ago

#1 @rmccue
2 years ago

  • Keywords needs-patch added

I'd be tempted to leave this until 4.8 and take a holistic look at multisite behaviour across all resources to make sure it works well. (We fixed #38526 in 4.7 since it was a bug, not to add full multisite functionality.)

@jeremyfelt Is this important enough to pull into 4.7?

This ticket was mentioned in Slack in #core by helen. View the logs.


2 years ago

#3 @jeremyfelt
2 years ago

  • Milestone changed from Awaiting Review to 4.7
  • Owner set to jeremyfelt
  • Status changed from new to assigned

Taking a look at this now for 4.7.

#4 @jeremyfelt
2 years ago

  • Milestone changed from 4.7 to 4.8

I started poking at this, but it seems like something that should be thought through some more first. Let's leave it at edit_users for now and then follow up in early 4.8.

This ticket was mentioned in Slack in #core-restapi by jeremyfelt. View the logs.


2 years ago

#6 @larsonreever
2 years ago

take a holistic look at multisite behaviour across all resources to make sure it works well.

Last edited 2 years ago by larsonreever (previous) (diff)

This ticket was mentioned in Slack in #core-multisite by flixos90. View the logs.


2 years ago

#8 @jeremyfelt
2 years ago

  • Milestone 4.8 deleted
  • Resolution set to invalid
  • Status changed from assigned to closed

The original functionality for adding existing users was disabled in 4.7.3 via [40106] as it was not part of a clear strategy. Let's close this ticket in favor of #39544, which aims to improve the users endpoint as a whole.

Note: See TracTickets for help on using tickets.