Make WordPress Core

Opened 4 weeks ago

Last modified 4 weeks ago

#65096 new enhancement

Add `is_user_member_of_blog` filter

Reported by: dd32's profile dd32 Owned by:
Milestone: 7.1 Priority: normal
Severity: normal Version:
Component: Role/Capability Keywords: has-patch has-unit-tests commit
Focuses: multisite Cc:

Description

WordPress uses is_user_member_of_blog() in the rest api controllers to prevent the user endpoints running for non-members of the site.

For WordPress.org this caused an issue as 'no' users are members of the site on which we wanted users to be able to use the rest-api endpoints for various account purposes.

This was resolved through faking the metadata such that it always returned truthful, without granting additional capabilities: https://github.com/WordPress/wporg-two-factor/pull/348#issuecomment-4206959949

I've run into another use-case for it, where I want to dynamically grant a user access to a site, but I don't want to give the user a role directly. Causing me to use the same metadata filter approach.

A filter on is_user_member_of_blog would make this a lot simpler.

Change History (2)

This ticket was mentioned in PR #11597 on WordPress/wordpress-develop by @dd32.


4 weeks ago
#1

  • Keywords has-patch has-unit-tests added

## Summary

  • Adds an is_user_member_of_blog filter so plugins can dynamically grant or revoke a user's membership of a blog without having to spoof {$prefix}capabilities user meta (as WordPress.org currently does for its REST API user endpoints).
  • The filter receives the computed membership, the resolved user ID, and the resolved blog ID, and only runs once the function has confirmed a valid user on a valid (non-archived/spam/deleted) multisite site — short-circuited paths (logged out, unknown user, invalid site) continue to return without invoking the filter, so the filter isn't load-bearing for "empty" inputs.
  • @since is 7.1.0, matching src/wp-includes/version.php on trunk.

## Test plan

  • [ ] phpunit --group ms-required tests/phpunit/tests/user/multisite.php — includes two new cases: one that forces the return value to true for a non-member and asserts the filter's arguments, and one that asserts the filter is *not* called for the short-circuited paths.
  • [ ] Manually register a filter on a multisite install and confirm the REST users controller now respects the filtered membership.

---

_Disclosure: this PR (code, tests, and description) was generated by Claude Code on behalf of @dd32, who reviewed it before submission._

#2 @dd32
4 weeks ago

  • Keywords commit added
  • Milestone changed from Awaiting Review to 7.1
Note: See TracTickets for help on using tickets.