vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2025-10-16 12:05:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Application Passwords: Allow a Super Admin to set an application password on a site they're not a member of.

Browse Source 
This removes the requirement that a Super Admin must be a member of the current site when they attempt to set an application password within the admin area of an individual site on the network.

Props TimothyBlynJacobs, ilovecats7, johnbillion, georgestephanis, johnjamesjacoby

Fixes #53224


git-svn-id: https://develop.svn.wordpress.org/trunk@53882 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
John Blackbourn 2022-08-11 18:22:59 +00:00
parent e999a8b281
commit 7bb8dc6269
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php
View File

@ -719,7 +719,7 @@ class WP_REST_Application_Passwords_Controller extends WP_REST_Controller {
return $error;
}
if ( is_multisite() && ! is_user_member_of_blog( $user->ID ) ) {
if ( is_multisite() && ! user_can( $user->ID, 'manage_sites' ) && ! is_user_member_of_blog( $user->ID ) ) {
return $error;
}

26
tests/phpunit/tests/rest-api/rest-application-passwords-controller.php
View File

@ -409,6 +409,32 @@ class WP_Test_REST_Application_Passwords_Controller extends WP_Test_REST_Control
$this->assertErrorResponse( 'rest_user_invalid_id', $response, 404 );
}
/**
* @ticket 53224
* @group ms-required
*/
public function test_create_item_for_super_admin_on_site_where_they_are_not_a_member() {
wp_set_current_user( self::$admin );
// Create a site where the Super Admin is not a member.
$blog_id = self::factory()->blog->create(
array(
'user_id' => self::$subscriber_id,
)
);
switch_to_blog( $blog_id );
$request = new WP_REST_Request( 'POST', '/wp/v2/users/me/application-passwords' );
$request->set_body_params( array( 'name' => 'App' ) );
$response = rest_do_request( $request );
restore_current_blog();
$this->assertNotWPError( $response );
$this->assertSame( 201, $response->get_status() );
}
/**
* @ticket 51939
*/