Make WordPress Core

Opened 17 months ago

Last modified 11 days ago

#58761 new defect (bug)

Make the filter option_page_capability_options available when access options.php directly

Reported by: amibe's profile amibe Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Options, Meta APIs Keywords:
Focuses: Cc:

Description

The problem is that when wp-admin/options.php is accessed directly $option_page is Empty, and the filter for option_page_capability_options is bypassed.

For a requirement to prevent direct access to this page, which exposes all WordPress options, this filter is needed to modify the capability from 'manage_options' to 'do_not_allow'.

For any other settings page the value of $option_page is set to something other than 'options' and would not be affected by this change.

I'd also suggest the 'back compat' comment is irrelevant and could be removed (or at least better explained if it is relevant).

The suggested change is from:

<?php
$capability = 'manage_options';

// This is for back compat and will eventually be removed.
if ( empty( $option_page ) ) {
        $option_page = 'options';
} else {

        /**
         * Filters the capability required when using the Settings API.
         *
         * By default, the options groups for all registered settings require the manage_options capability.
         * This filter is required to change the capability required for a certain options page.
         *
         * @since 3.2.0
         *
         * @param string $capability The capability used for the page, which is manage_options by default.
         */
        $capability = apply_filters( "option_page_capability_{$option_page}", $capability );
}

To:

<?php
$capability = 'manage_options';

if ( empty( $option_page ) ) {
        $option_page = 'options';
} 

/**
 * Filters the capability required when using the Settings API.
 *
 * By default, the options groups for all registered settings require the manage_options capability.
 * This filter is required to change the capability required for a certain options page.
 *
 * @since 3.2.0
 *
 * @param string $capability The capability used for the page, which is manage_options by default.
 */
$capability = apply_filters( "option_page_capability_{$option_page}", $capability );

Change History (0)

Note: See TracTickets for help on using tickets.