Make WordPress Core

Opened 13 hours ago

Last modified 7 hours ago

#65750 new defect (bug)

Compression test sends unauthorized AJAX requests for users without manage_options

Reported by: szepe.viktor Owned by:
Priority: normal Milestone: Awaiting Review
Component: Script Loader Version: 2.8
Severity: minor Keywords: has-patch has-unit-tests
Cc: Focuses:

Description

When the can_compress_scripts option does not exist, wp-admin/admin-footer.php calls compression_test() for every user who can access wp-admin.

The function outputs JavaScript which sends requests to the wp-compression-test AJAX action. However, the AJAX callback requires the manage_options capability. Users without this capability, such as Editors, therefore receive -1 responses.

This also conflicts with the compression_test() documentation, which states that the function has no effect when the current user is not an administrator.

Steps to reproduce:

  1. Delete the can_compress_scripts option.
  2. Log in as a user with the Editor role.
  3. Open any wp-admin page.
  4. Inspect the browser network requests.
  5. Observe requests to admin-ajax.php?action=wp-compression-test returning -1.

Expected result:

The compression test JavaScript should not be output for users who cannot perform the corresponding AJAX action.

Actual result:

The JavaScript is output, makes unauthorized AJAX requests, and cannot update the option.

Change History (2)

This ticket was mentioned in PR #12748 on WordPress/wordpress-develop by @irozum.


11 hours ago
#1

  • Keywords has-patch has-unit-tests added; needs-patch removed

compression_test() is called from wp-admin/admin-footer.php for every user who can access wp-admin, whenever the can_compress_scripts option is unset — not only administrators. It outputs a <script> block that fires AJAX requests to the wp-compression-test action, but that AJAX handler (wp_ajax_wp_compression_test()) requires the manage_options capability, so non-admin users (e.g. Editors) get -1 responses and can never actually resolve the test. This also contradicts the function's own docblock, which states it "Has no effect when the current user is not an administrator."

This PR adds a current_user_can( 'manage_options' ) check at the top of compression_test() so it returns early — and outputs nothing — for users who can't act on the result, matching the documented behavior. Administrators are unaffected.

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5
Used for: Implementation, tests, and PR description. Reviewed by Igor Rozum.

Note: See TracTickets for help on using tickets.