diff --git a/src/wp-includes/class-wp-customize-nav-menus.php b/src/wp-includes/class-wp-customize-nav-menus.php index 24384322a0..b4bd0fd0f4 100644 --- a/src/wp-includes/class-wp-customize-nav-menus.php +++ b/src/wp-includes/class-wp-customize-nav-menus.php @@ -48,6 +48,11 @@ final class WP_Customize_Nav_Menus { $this->previewed_menus = array(); $this->manager = $manager; + // Skip useless hooks when the user can't manage nav menus anyway. + if ( ! current_user_can( 'edit_theme_options' ) ) { + return; + } + add_filter( 'customize_refresh_nonces', array( $this, 'filter_nonces' ) ); add_action( 'wp_ajax_load-available-menu-items-customizer', array( $this, 'ajax_load_available_items' ) ); add_action( 'wp_ajax_search-available-menu-items-customizer', array( $this, 'ajax_search_available_items' ) ); diff --git a/src/wp-includes/class-wp-customize-widgets.php b/src/wp-includes/class-wp-customize-widgets.php index 28eaf1283a..ca171b2e57 100644 --- a/src/wp-includes/class-wp-customize-widgets.php +++ b/src/wp-includes/class-wp-customize-widgets.php @@ -84,6 +84,11 @@ final class WP_Customize_Widgets { public function __construct( $manager ) { $this->manager = $manager; + // Skip useless hooks when the user can't manage widgets anyway. + if ( ! current_user_can( 'edit_theme_options' ) ) { + return; + } + add_filter( 'customize_dynamic_setting_args', array( $this, 'filter_customize_dynamic_setting_args' ), 10, 2 ); add_action( 'after_setup_theme', array( $this, 'register_settings' ) ); add_action( 'wp_loaded', array( $this, 'override_sidebars_widgets_for_theme_switch' ) ); diff --git a/tests/phpunit/tests/customize/widgets.php b/tests/phpunit/tests/customize/widgets.php index bcb24b22d7..c485b36aa7 100644 --- a/tests/phpunit/tests/customize/widgets.php +++ b/tests/phpunit/tests/customize/widgets.php @@ -23,6 +23,9 @@ class Tests_WP_Customize_Widgets extends WP_UnitTestCase { function setUp() { parent::setUp(); require_once( ABSPATH . WPINC . '/class-wp-customize-manager.php' ); + + $user_id = self::factory()->user->create( array( 'role' => 'administrator' ) ); + wp_set_current_user( $user_id ); $GLOBALS['wp_customize'] = new WP_Customize_Manager(); $this->manager = $GLOBALS['wp_customize']; @@ -41,9 +44,6 @@ class Tests_WP_Customize_Widgets extends WP_UnitTestCase { remove_action( 'after_setup_theme', 'twentysixteen_setup' ); remove_action( 'customize_register', 'twentysixteen_customize_register', 11 ); - $user_id = self::factory()->user->create( array( 'role' => 'administrator' ) ); - wp_set_current_user( $user_id ); - $this->backup_registered_sidebars = $GLOBALS['wp_registered_sidebars']; }