diff --git a/src/wp-includes/capabilities.php b/src/wp-includes/capabilities.php index 3ff0481fd4..5ee344b390 100644 --- a/src/wp-includes/capabilities.php +++ b/src/wp-includes/capabilities.php @@ -888,7 +888,7 @@ function get_super_admins() { * @return bool Whether the user is a site admin. */ function is_super_admin( $user_id = false ) { - if ( ! $user_id || get_current_user_id() == $user_id ) { + if ( ! $user_id ) { $user = wp_get_current_user(); } else { $user = get_userdata( $user_id ); diff --git a/tests/phpunit/tests/auth.php b/tests/phpunit/tests/auth.php index 3567a8bba5..3936f0772d 100644 --- a/tests/phpunit/tests/auth.php +++ b/tests/phpunit/tests/auth.php @@ -635,4 +635,44 @@ class Tests_Auth extends WP_UnitTestCase { $this->assertNull( wp_validate_application_password( null ) ); } + + /** + * @ticket 53386 + * @dataProvider data_application_passwords_can_use_capability_checks_to_determine_feature_availability + */ + public function test_application_passwords_can_use_capability_checks_to_determine_feature_availability( $role, $authenticated ) { + $user = self::factory()->user->create_and_get( array( 'role' => $role ) ); + + list( $password ) = WP_Application_Passwords::create_new_application_password( $user->ID, array( 'name' => 'phpunit' ) ); + + add_filter( 'application_password_is_api_request', '__return_true' ); + add_filter( 'wp_is_application_passwords_available', '__return_true' ); + add_filter( + 'wp_is_application_passwords_available_for_user', + static function ( $available, WP_User $user ) { + return user_can( $user, 'edit_posts' ); + }, + 10, + 2 + ); + + $_SERVER['PHP_AUTH_USER'] = $user->user_login; + $_SERVER['PHP_AUTH_PW'] = $password; + + unset( $GLOBALS['current_user'] ); + $current = get_current_user_id(); + + if ( $authenticated ) { + $this->assertSame( $user->ID, $current ); + } else { + $this->assertSame( 0, $current ); + } + } + + public function data_application_passwords_can_use_capability_checks_to_determine_feature_availability() { + return array( + 'allowed' => array( 'editor', true ), + 'not allowed' => array( 'subscriber', false ), + ); + } }