vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-03-31 02:34:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Role/Capability: Add support for capability queries in WP_User_Query.

Browse Source 
Similar to the existing `role`/`role__in`/`role__not_in` query arguments, this adds support for three new query arguments in `WP_User_Query`:

* `capability` 
* `capability__in`
* `capability__not_in`

These can be used to fetch users with (or without) a specific set of capabilities, for example to get all users
with the capability to edit a certain post type.

Under the hood, this will check all existing roles on the site and perform a `LIKE` query against the `capabilities` user meta field to find:

* all users with a role that has this capability
* all users with the capability being assigned directly

Note: In WordPress, not all capabilities are stored in the database. Capabilities can also be modified using filters like `map_meta_cap`. These new query arguments do NOT work for such capabilities.

The prime use case for capability queries is to get all "authors", i.e. users with the capability to edit a certain post type.

Until now, `'who' => 'authors'` was used for this, which relies on user levels. However, user levels were deprecated a long time ago and thus never added to custom roles. This led to constant frustration due to users with custom roles missing from places like author dropdowns.

This updates any usage of `'who' => 'authors'` in core to use capability queries instead.

Subsequently, `'who' => 'authors'` queries are being **deprecated** in favor of these new query arguments.

Also adds a new `capabilities` parameter (mapping to `capability__in` in `WP_User_Query`) to the REST API users controller.

Also updates `twentyfourteen_list_authors()` in Twenty Fourteen to make use of this new functionality, adding a new `twentyfourteen_list_authors_query_args` filter to make it easier to override this behavior.

Props scribu, lgladdly, boonebgorges, spacedmonkey, peterwilsoncc, SergeyBiryukov, swissspidy.
Fixes #16841.


git-svn-id: https://develop.svn.wordpress.org/trunk@51943 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Pascal Birchler
2021-10-27 18:42:13 +00:00
parent c043d40900
commit 0cf6d3e48d
10 changed files with 535 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
tests/phpunit/tests/rest-api/rest-users-controller.php
View File

@@ -15,6 +15,7 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
protected static $editor;
protected static $draft_editor;
protected static $subscriber;
protected static $author;
protected static $authors = array();
protected static $posts = array();
@@ -55,6 +56,13 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
'user_email' => 'subscriber@example.com',
)
);
self::$author = $factory->user->create(
array(
'display_name' => 'author',
'role' => 'author',
'user_email' => 'author@example.com',
)
);
foreach ( array( true, false ) as $show_in_rest ) {
foreach ( array( true, false ) as $public ) {
@@ -107,7 +115,7 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
}
// Set up users for pagination tests.
for ( $i = 0; $i < self::$total_users - 10; $i++ ) {
for ( $i = 0; $i < self::$total_users - 11; $i++ ) {
self::$user_ids[] = $factory->user->create(
array(
'role' => 'contributor',
@@ -121,6 +129,7 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
self::delete_user( self::$user );
self::delete_user( self::$editor );
self::delete_user( self::$draft_editor );
self::delete_user( self::$author );
foreach ( self::$posts as $post ) {
wp_delete_post( $post, true );
@@ -183,8 +192,7 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$keys = array_keys( $data['endpoints'][0]['args'] );
sort( $keys );
$this->assertSame(
$this->assertEqualSets(
array(
'context',
'exclude',
@@ -195,6 +203,7 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
'page',
'per_page',
'roles',
'capabilities',
'search',
'slug',
'who',
@@ -795,32 +804,19 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
public function test_get_items_roles() {
wp_set_current_user( self::$user );
$tango = $this->factory->user->create(
array(
'display_name' => 'tango',
'role' => 'subscriber',
)
);
$yolo = $this->factory->user->create(
array(
'display_name' => 'yolo',
'role' => 'author',
)
);
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'roles', 'author,subscriber' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 3, $data );
$this->assertSame( $tango, $data[1]['id'] );
$this->assertSame( $yolo, $data[2]['id'] );
$this->assertCount( 2, $data );
$this->assertSame( self::$author, $data[0]['id'] );
$this->assertSame( self::$subscriber, $data[1]['id'] );
$request->set_param( 'roles', 'author' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 1, $data );
$this->assertSame( $yolo, $data[0]['id'] );
$this->assertSame( self::$author, $data[0]['id'] );
wp_set_current_user( 0 );
@@ -838,28 +834,86 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
public function test_get_items_invalid_roles() {
wp_set_current_user( self::$user );
$lolz = $this->factory->user->create(
array(
'display_name' => 'lolz',
'role' => 'author',
)
);
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'roles', 'ilovesteak,author' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 1, $data );
$this->assertSame( self::$author, $data[0]['id'] );
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'roles', 'steakisgood' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertIsArray( $data );
$this->assertEmpty( $data );
}
/**
* @ticket 16841
*/
public function test_get_items_capabilities() {
wp_set_current_user( self::$user );
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'capabilities', 'edit_posts' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertNotEmpty( $data );
foreach ( $data as $user ) {
$this->assertTrue( user_can( $user['id'], 'edit_posts' ) );
}
}
/**
* @ticket 16841
*/
public function test_get_items_capabilities_no_permission_no_user() {
wp_set_current_user( 0 );
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'capabilities', 'edit_posts' );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_user_cannot_view', $response, 401 );
}
/**
* @ticket 16841
*/
public function test_get_items_capabilities_no_permission_editor() {
wp_set_current_user( self::$editor );
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'capabilities', 'edit_posts' );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_user_cannot_view', $response, 403 );
}
/**
* @ticket 16841
*/
public function test_get_items_invalid_capabilities() {
wp_set_current_user( self::$user );
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'roles', 'ilovesteak,author' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 1, $data );
$this->assertSame( $lolz, $data[0]['id'] );
$this->assertSame( self::$author, $data[0]['id'] );
$request = new WP_REST_Request( 'GET', '/wp/v2/users' );
$request->set_param( 'roles', 'steakisgood' );
$request->set_param( 'capabilities', 'steakisgood' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertCount( 0, $data );
$this->assertSame( array(), $data );
$this->assertIsArray( $data );
$this->assertEmpty( $data );
}
/**
* @expectedDeprecated WP_User_Query
*/
public function test_get_items_who_author_query() {
wp_set_current_user( self::$superadmin );

241
tests/phpunit/tests/user/query.php
View File

@@ -730,6 +730,7 @@ class Tests_User_Query extends WP_UnitTestCase {
/**
* @ticket 32019
* @group ms-required
* @expectedDeprecated WP_User_Query
*/
public function test_who_authors() {
$b = self::factory()->blog->create();
@@ -755,6 +756,7 @@ class Tests_User_Query extends WP_UnitTestCase {
/**
* @ticket 32019
* @group ms-required
* @expectedDeprecated WP_User_Query
*/
public function test_who_authors_should_work_alongside_meta_query() {
$b = self::factory()->blog->create();
@@ -789,6 +791,7 @@ class Tests_User_Query extends WP_UnitTestCase {
/**
* @ticket 36724
* @group ms-required
* @expectedDeprecated WP_User_Query
*/
public function test_who_authors_should_work_alongside_meta_params() {
$b = self::factory()->blog->create();
@@ -1725,4 +1728,242 @@ class Tests_User_Query extends WP_UnitTestCase {
return array( 555 );
}
/**
* @ticket 16841
* @group ms-excluded
*/
public function test_get_single_capability_by_string() {
$wp_user_search = new WP_User_Query( array( 'capability' => 'install_plugins' ) );
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
// User has the capability, but on Multisite they would also need to be a super admin.
// Hence using get_role_caps() instead of has_cap().
$role_caps = $user->get_role_caps();
$this->assertArrayHasKey( 'install_plugins', $role_caps );
$this->assertTrue( $role_caps['install_plugins'] );
}
}
/**
* @ticket 16841
* @group ms-required
*/
public function test_get_single_capability_by_string_multisite() {
$wp_user_search = new WP_User_Query( array( 'capability' => array( 'install_plugins' ) ) );
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
$role_caps = $user->get_role_caps();
$this->assertArrayHasKey( 'install_plugins', $role_caps );
$this->assertTrue( $role_caps['install_plugins'] );
// While the user can have the capability, on Multisite they also need to be a super admin.
if ( is_super_admin( $user->ID ) ) {
$this->assertTrue( $user->has_cap( 'install_plugins' ) );
} else {
$this->assertFalse( $user->has_cap( 'install_plugins' ) );
}
}
}
/**
* @ticket 16841
*/
public function test_get_single_capability_invalid() {
$wp_user_search = new WP_User_Query( array( 'capability' => 'foo_bar' ) );
$users = $wp_user_search->get_results();
$this->assertEmpty( $users );
}
/**
* @ticket 16841
*/
public function test_get_single_capability_by_array() {
$wp_user_search = new WP_User_Query( array( 'capability' => array( 'install_plugins' ) ) );
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
// User has the capability, but on Multisite they would also need to be a super admin.
// Hence using get_role_caps() instead of has_cap().
$role_caps = $user->get_role_caps();
$this->assertArrayHasKey( 'install_plugins', $role_caps );
$this->assertTrue( $role_caps['install_plugins'] );
}
}
/**
* @ticket 16841
*/
public function test_get_single_capability_added_to_user() {
foreach ( self::$sub_ids as $subscriber ) {
$subscriber = get_user_by( 'ID', $subscriber );
$subscriber->add_cap( 'custom_cap' );
}
$wp_user_search = new WP_User_Query( array( 'capability' => 'custom_cap' ) );
$users = $wp_user_search->get_results();
$this->assertCount( 2, $users );
$this->assertEqualSets( self::$sub_ids, wp_list_pluck( $users, 'ID' ) );
foreach ( $users as $user ) {
$this->assertTrue( $user->has_cap( 'custom_cap' ) );
}
}
/**
* @ticket 16841
*/
public function test_get_multiple_capabilities_should_only_match_users_who_have_each_capability_test() {
wp_roles()->add_role( 'role_1', 'Role 1', array( 'role_1_cap' => true ) );
wp_roles()->add_role( 'role_2', 'Role 2', array( 'role_2_cap' => true ) );
$subscriber1 = get_user_by( 'ID', self::$sub_ids[0] );
$subscriber1->add_role( 'role_1' );
$subscriber2 = get_user_by( 'ID', self::$sub_ids[1] );
$subscriber2->add_role( 'role_1' );
$subscriber2->add_role( 'role_2' );
$wp_user_search = new WP_User_Query( array( 'capability' => array( 'role_1_cap', 'role_2_cap' ) ) );
$users = $wp_user_search->get_results();
$this->assertCount( 1, $users );
$this->assertSame( $users[0]->ID, $subscriber2->ID );
foreach ( $users as $user ) {
$this->assertTrue( $user->has_cap( 'role_1_cap' ) );
$this->assertTrue( $user->has_cap( 'role_2_cap' ) );
}
}
/**
* @ticket 16841
*/
public function test_get_multiple_capabilities_should_only_match_users_who_have_each_capability_added_to_user() {
$admin1 = get_user_by( 'ID', self::$admin_ids[0] );
$admin1->add_cap( 'custom_cap' );
$wp_user_search = new WP_User_Query( array( 'capability' => array( 'manage_options', 'custom_cap' ) ) );
$users = $wp_user_search->get_results();
$this->assertCount( 1, $users );
$this->assertSame( $users[0]->ID, $admin1->ID );
$this->assertTrue( $users[0]->has_cap( 'custom_cap' ) );
$this->assertTrue( $users[0]->has_cap( 'manage_options' ) );
}
/**
* @ticket 16841
*/
public function test_get_multiple_capabilities_or() {
$wp_user_search = new WP_User_Query( array( 'capability__in' => array( 'publish_posts', 'edit_posts' ) ) );
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
$this->assertTrue( $user->has_cap( 'publish_posts' ) || $user->has_cap( 'edit_posts' ) );
}
}
/**
* @ticket 16841
*/
public function test_get_multiple_capabilities_or_added_to_user() {
$user = self::factory()->user->create_and_get( array( 'role' => 'subscriber' ) );
$user->add_cap( 'custom_cap' );
$wp_user_search = new WP_User_Query( array( 'capability__in' => array( 'publish_posts', 'custom_cap' ) ) );
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
$this->assertTrue( $user->has_cap( 'publish_posts' ) || $user->has_cap( 'custom_cap' ) );
}
}
/**
* @ticket 16841
*/
public function test_capability_exclusion() {
$wp_user_search = new WP_User_Query( array( 'capability__not_in' => array( 'publish_posts', 'edit_posts' ) ) );
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
$this->assertFalse( $user->has_cap( 'publish_posts' ) );
$this->assertFalse( $user->has_cap( 'edit_posts' ) );
}
}
/**
* @ticket 16841
*/
public function test_capability_exclusion_added_to_user() {
$user = self::factory()->user->create_and_get( array( 'role' => 'subscriber' ) );
$user->add_cap( 'custom_cap' );
$wp_user_search = new WP_User_Query( array( 'capability__not_in' => array( 'publish_posts', 'custom_cap' ) ) );
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
$this->assertFalse( $user->has_cap( 'publish_posts' ) );
$this->assertFalse( $user->has_cap( 'custom_cap' ) );
}
}
/**
* @ticket 16841
*/
public function test_capability__in_capability__not_in_combined() {
$wp_user_search = new WP_User_Query(
array(
'capability__in' => array( 'read' ),
'capability__not_in' => array( 'manage_options' ),
)
);
$users = $wp_user_search->get_results();
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
$this->assertTrue( $user->has_cap( 'read' ) );
$this->assertFalse( $user->has_cap( 'manage_options' ) );
}
}
/**
* @ticket 16841
* @group ms-required
*/
public function test_get_single_capability_multisite_blog_id() {
$blog_id = self::factory()->blog->create();
add_user_to_blog( $blog_id, self::$author_ids[0], 'subscriber' );
add_user_to_blog( $blog_id, self::$author_ids[1], 'author' );
add_user_to_blog( $blog_id, self::$author_ids[2], 'editor' );
$wp_user_search = new WP_User_Query(
array(
'capability' => 'publish_posts',
'blog_id' => $blog_id,
)
);
$users = $wp_user_search->get_results();
$found = wp_list_pluck( $wp_user_search->get_results(), 'ID' );
$this->assertNotEmpty( $users );
foreach ( $users as $user ) {
$this->assertTrue( $user->has_cap( 'publish_posts' ) );
}
$this->assertNotContains( self::$author_ids[0], $found );
$this->assertContains( self::$author_ids[1], $found );
$this->assertContains( self::$author_ids[2], $found );
}
}

3
tests/phpunit/tests/xmlrpc/wp/getUsers.php
View File

@@ -54,6 +54,9 @@ class Tests_XMLRPC_wp_getUsers extends WP_XMLRPC_UnitTestCase {
$this->assertSame( 403, $results->code );
}
/**
* @expectedDeprecated WP_User_Query
*/
function test_role_filter() {
$author_id = $this->make_user_by_role( 'author' );
$editor_id = $this->make_user_by_role( 'editor' );