Site health: Introduce view_site_health_checks capability.

Introduces the faux primitive capability `view_site_health_checks` available to single site admins and multisite super-admin to view the site health page within the admin.

The capability is mapped to the `install_plugins` capability without being dependent on the file system being writable. This fixes a bug where the feature couldn't be used by sites unable to write to the file system or managed through version control.

The capability is granted on the `user_has_cap` filter.

Props birgire, Clorith, palmiak, peterwilsoncc, spacedmonkey.
Fixes #46957.



git-svn-id: https://develop.svn.wordpress.org/trunk@45507 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-admin/includes/ajax-actions.php

@@ -4869,7 +4869,7 @@ function wp_ajax_wp_privacy_erase_personal_data() {
 function wp_ajax_health_check_dotorg_communication() {
 	check_ajax_referer( 'health-check-site-status' );
 
-	if ( ! current_user_can( 'install_plugins' ) ) {
+	if ( ! current_user_can( 'view_site_health_checks' ) ) {
 		wp_send_json_error();
 	}
 
@@ -4889,7 +4889,7 @@ function wp_ajax_health_check_dotorg_communication() {
 function wp_ajax_health_check_is_in_debug_mode() {
 	wp_verify_nonce( 'health-check-site-status' );
 
-	if ( ! current_user_can( 'install_plugins' ) ) {
+	if ( ! current_user_can( 'view_site_health_checks' ) ) {
 		wp_send_json_error();
 	}
 
@@ -4909,7 +4909,7 @@ function wp_ajax_health_check_is_in_debug_mode() {
 function wp_ajax_health_check_background_updates() {
 	check_ajax_referer( 'health-check-site-status' );
 
-	if ( ! current_user_can( 'install_plugins' ) ) {
+	if ( ! current_user_can( 'view_site_health_checks' ) ) {
 		wp_send_json_error();
 	}
 
@@ -4930,7 +4930,7 @@ function wp_ajax_health_check_background_updates() {
 function wp_ajax_health_check_loopback_requests() {
 	check_ajax_referer( 'health-check-site-status' );
 
-	if ( ! current_user_can( 'install_plugins' ) ) {
+	if ( ! current_user_can( 'view_site_health_checks' ) ) {
 		wp_send_json_error();
 	}
 
@@ -4950,7 +4950,7 @@ function wp_ajax_health_check_loopback_requests() {
 function wp_ajax_health_check_site_status_result() {
 	check_ajax_referer( 'health-check-site-status-result' );
 
-	if ( ! current_user_can( 'install_plugins' ) ) {
+	if ( ! current_user_can( 'view_site_health_checks' ) ) {
 		wp_send_json_error();
 	}
 
@@ -4967,7 +4967,7 @@ function wp_ajax_health_check_site_status_result() {
 function wp_ajax_health_check_get_sizes() {
 	check_ajax_referer( 'health-check-site-status-result' );
 
-	if ( ! current_user_can( 'install_plugins' ) || is_multisite() ) {
+	if ( ! current_user_can( 'view_site_health_checks' ) || is_multisite() ) {
 		wp_send_json_error();
 	}
 

src/wp-admin/menu.php

@@ -263,7 +263,7 @@ $menu[75]                     = array( __( 'Tools' ), 'edit_posts', 'tools.php',
 	$submenu['tools.php'][5]  = array( __( 'Available Tools' ), 'edit_posts', 'tools.php' );
 	$submenu['tools.php'][10] = array( __( 'Import' ), 'import', 'import.php' );
 	$submenu['tools.php'][15] = array( __( 'Export' ), 'export', 'export.php' );
-	$submenu['tools.php'][20] = array( __( 'Site Health' ), 'install_plugins', 'site-health.php' );
+	$submenu['tools.php'][20] = array( __( 'Site Health' ), 'view_site_health_checks', 'site-health.php' );
 	$submenu['tools.php'][25] = array( __( 'Export Personal Data' ), 'export_others_personal_data', 'export-personal-data.php' );
 	$submenu['tools.php'][30] = array( __( 'Erase Personal Data' ), 'erase_others_personal_data', 'erase-personal-data.php' );
 if ( is_multisite() && ! is_main_site() ) {

src/wp-admin/site-health-info.php

@@ -11,7 +11,7 @@ require_once( dirname( __FILE__ ) . '/admin.php' );
 
 $title = __( 'Site Health Info' );
 
-if ( ! current_user_can( 'install_plugins' ) ) {
+if ( ! current_user_can( 'view_site_health_checks' ) ) {
 	wp_die( __( 'Sorry, you are not allowed to access the debug data.' ), '', 403 );
 }
 

src/wp-admin/site-health.php

@@ -16,7 +16,7 @@ require_once( dirname( __FILE__ ) . '/admin.php' );
 
 $title = __( 'Site Health Status' );
 
-if ( ! current_user_can( 'install_plugins' ) ) {
+if ( ! current_user_can( 'view_site_health_checks' ) ) {
 	wp_die( __( 'Sorry, you are not allowed to access site health information.' ), '', 403 );
 }
 

src/wp-includes/capabilities.php

@@ -1025,6 +1025,31 @@ function wp_maybe_grant_resume_extensions_caps( $allcaps ) {
 	return $allcaps;
 }
 
+/**
+ * Filters the user capabilities to grant the 'view_site_health_checks' capabilities as necessary.
+ *
+ * @since 5.2.2
+ *
+ * @param bool[]   $allcaps An array of all the user's capabilities.
+ * @param string[] $caps    Required primitive capabilities for the requested capability.
+ * @param array    $args {
+ *     Arguments that accompany the requested capability check.
+ *
+ *     @type string    $0 Requested capability.
+ *     @type int       $1 Concerned user ID.
+ *     @type mixed  ...$2 Optional second and further parameters, typically object ID.
+ * }
+ * @param WP_User  $user    The user object.
+ * @return bool[] Filtered array of the user's capabilities.
+ */
+function wp_maybe_grant_site_health_caps( $allcaps, $caps, $args, $user ) {
+	if ( ! empty( $allcaps['install_plugins'] ) && ( ! is_multisite() || is_super_admin( $user->ID ) ) ) {
+		$allcaps['view_site_health_checks'] = true;
+	}
+
+	return $allcaps;
+}
+
 return;
 
 // Dummy gettext calls to get strings in the catalog.

src/wp-includes/default-filters.php

@@ -580,5 +580,6 @@ add_filter( 'pre_oembed_result', 'wp_filter_pre_oembed_result', 10, 3 );
 // Capabilities
 add_filter( 'user_has_cap', 'wp_maybe_grant_install_languages_cap', 1 );
 add_filter( 'user_has_cap', 'wp_maybe_grant_resume_extensions_caps', 1 );
+add_filter( 'user_has_cap', 'wp_maybe_grant_site_health_caps', 1, 4 );
 
 unset( $filter, $action );