vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 20:30:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

REST API: Improve permission handling in global style endpoint.

Browse Source 
The new wp_global_styles post type is registered to use edit_theme_options in the capability settings. The WP_REST_Global_Styles_Controller class's permission checks methods use the capability in a hard coded form rather than looking up the capability via the post type object. Changing the permission callbacks to lookup capabilities via the post type object, allows theme and plugin developers to modify the capability used for editing global styles via a filter and these values to be respected via the Global Styles REST API.

Props Spacedmonkey, peterwilsoncc, hellofromTonya , antonvlasenko, TimothyBlynJacobs, costdev, zieladam.
Fixes #54516.



git-svn-id: https://develop.svn.wordpress.org/trunk@52342 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jonny Harris
2021-12-07 20:56:18 +00:00
parent f33c456925
commit 9f0d8fdf01
2 changed files with 312 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phpunit/tests/rest-api/rest-global-styles-controller.php
+200 -12
View File
@@ -7,6 +7,7 @@
*/
/**
* @covers WP_REST_Global_Styles_Controller
* @group restapi-global-styles
* @group restapi
*/
@@ -16,11 +17,21 @@ class WP_REST_Global_Styles_Controller_Test extends WP_Test_REST_Controller_Test
*/
protected static $admin_id;
/**
* @var int
*/
protected static $subscriber_id;
/**
* @var int
*/
protected static $global_styles_id;
/**
* @var int
*/
protected static $post_id;
private function find_and_normalize_global_styles_by_id( $global_styles, $id ) {
foreach ( $global_styles as $style ) {
if ( $style['id'] === $id ) {
@@ -48,8 +59,15 @@ class WP_REST_Global_Styles_Controller_Test extends WP_Test_REST_Controller_Test
'role' => 'administrator',
)
);
self::$subscriber_id = $factory->user->create(
array(
'role' => 'subscriber',
)
);
// This creates the global styles for the current theme.
self::$global_styles_id = wp_insert_post(
self::$global_styles_id = $factory->post->create(
array(
'post_content' => '{"version": ' . WP_Theme_JSON::LATEST_SCHEMA . ', "isGlobalStylesUserThemeJSON": true }',
'post_status' => 'publish',
@@ -59,25 +77,147 @@ class WP_REST_Global_Styles_Controller_Test extends WP_Test_REST_Controller_Test
'tax_input' => array(
'wp_theme' => 'tt1-blocks',
),
),
true
)
);
self::$post_id = $factory->post->create();
}
/**
*
*/
public static function wpTearDownAfterClass() {
self::delete_user( self::$admin_id );
self::delete_user( self::$subscriber_id );
}
/**
* @covers WP_REST_Global_Styles_Controller::register_routes
*/
public function test_register_routes() {
$routes = rest_get_server()->get_routes();
$this->assertArrayHasKey( '/wp/v2/global-styles/(?P<id>[\/\w-]+)', $routes );
$this->assertCount( 2, $routes['/wp/v2/global-styles/(?P<id>[\/\w-]+)'] );
$this->assertArrayHasKey( '/wp/v2/global-styles/themes/(?P<stylesheet>[^.\/]+(?:\/[^.\/]+)?)', $routes );
$this->assertCount( 1, $routes['/wp/v2/global-styles/themes/(?P<stylesheet>[^.\/]+(?:\/[^.\/]+)?)'] );
}
public function test_context_param() {
// TODO: Implement test_context_param() method.
$this->markTestIncomplete();
$this->markTestSkipped( 'Controller does not implement context_param().' );
}
public function test_get_items() {
$this->markTestIncomplete();
$this->markTestSkipped( 'Controller does not implement get_items().' );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_theme_item
* @ticket 54516
*/
public function test_get_theme_item_no_user() {
wp_set_current_user( 0 );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/themes/tt1-blocks' );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_cannot_manage_global_styles', $response, 401 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_theme_item
* @ticket 54516
*/
public function test_get_theme_item_permission_check() {
wp_set_current_user( self::$subscriber_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/themes/tt1-blocks' );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_cannot_manage_global_styles', $response, 403 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_theme_item
* @ticket 54516
*/
public function test_get_theme_item_invalid() {
wp_set_current_user( self::$admin_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/themes/invalid' );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_theme_not_found', $response, 404 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_theme_item
*/
public function test_get_theme_item() {
wp_set_current_user( self::$admin_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/themes/tt1-blocks' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
unset( $data['_links'] );
$this->assertArrayHasKey( 'settings', $data );
$this->assertArrayHasKey( 'styles', $data );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_item
* @ticket 54516
*/
public function test_get_item_no_user() {
wp_set_current_user( 0 );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/' . self::$global_styles_id );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_cannot_view', $response, 401 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_item
* @ticket 54516
*/
public function test_get_item_invalid_post() {
wp_set_current_user( self::$admin_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/' . self::$post_id );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_global_styles_not_found', $response, 404 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_item
* @ticket 54516
*/
public function test_get_item_permission_check() {
wp_set_current_user( self::$subscriber_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/' . self::$global_styles_id );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_cannot_view', $response, 403 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_item
* @ticket 54516
*/
public function test_get_item_no_user_edit() {
wp_set_current_user( 0 );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/' . self::$global_styles_id );
$request->set_param( 'context', 'edit' );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_forbidden_context', $response, 401 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_item
* @ticket 54516
*/
public function test_get_item_permission_check_edit() {
wp_set_current_user( self::$subscriber_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/' . self::$global_styles_id );
$request->set_param( 'context', 'edit' );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_forbidden_context', $response, 403 );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_item
*/
public function test_get_item() {
wp_set_current_user( self::$admin_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/global-styles/' . self::$global_styles_id );
@@ -100,9 +240,13 @@ class WP_REST_Global_Styles_Controller_Test extends WP_Test_REST_Controller_Test
}
public function test_create_item() {
$this->markTestIncomplete();
$this->markTestSkipped( 'Controller does not implement create_item().' );
}
/**
* @covers WP_REST_Global_Styles_Controller::update_item
* @ticket 54516
*/
public function test_update_item() {
wp_set_current_user( self::$admin_id );
$request = new WP_REST_Request( 'PUT', '/wp/v2/global-styles/' . self::$global_styles_id );
@@ -116,17 +260,61 @@ class WP_REST_Global_Styles_Controller_Test extends WP_Test_REST_Controller_Test
$this->assertEquals( 'My new global styles title', $data['title']['raw'] );
}
/**
* @covers WP_REST_Global_Styles_Controller::update_item
* @ticket 54516
*/
public function test_update_item_no_user() {
wp_set_current_user( 0 );
$request = new WP_REST_Request( 'PUT', '/wp/v2/global-styles/' . self::$global_styles_id );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_cannot_edit', $response, 401 );
}
/**
* @covers WP_REST_Global_Styles_Controller::update_item
* @ticket 54516
*/
public function test_update_item_invalid_post() {
wp_set_current_user( self::$admin_id );
$request = new WP_REST_Request( 'PUT', '/wp/v2/global-styles/' . self::$post_id );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_global_styles_not_found', $response, 404 );
}
/**
* @covers WP_REST_Global_Styles_Controller::update_item
* @ticket 54516
*/
public function test_update_item_permission_check() {
wp_set_current_user( self::$subscriber_id );
$request = new WP_REST_Request( 'PUT', '/wp/v2/global-styles/' . self::$global_styles_id );
$response = rest_get_server()->dispatch( $request );
$this->assertErrorResponse( 'rest_cannot_edit', $response, 403 );
}
public function test_delete_item() {
$this->markTestIncomplete();
$this->markTestSkipped( 'Controller does not implement delete_item().' );
}
public function test_prepare_item() {
// TODO: Implement test_prepare_item() method.
$this->markTestIncomplete();
$this->markTestSkipped( 'Controller does not implement prepare_item().' );
}
/**
* @covers WP_REST_Global_Styles_Controller::get_item_schema
* @ticket 54516
*/
public function test_get_item_schema() {
// TODO: Implement test_get_item_schema() method.
$this->markTestIncomplete();
$request = new WP_REST_Request( 'OPTIONS', '/wp/v2/global-styles/' . self::$global_styles_id );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$properties = $data['schema']['properties'];
$this->assertCount( 4, $properties, 'Schema properties array does not have exactly 4 elements' );
$this->assertArrayHasKey( 'id', $properties, 'Schema properties array does not have "id" key' );
$this->assertArrayHasKey( 'styles', $properties, 'Schema properties array does not have "styles" key' );
$this->assertArrayHasKey( 'settings', $properties, 'Schema properties array does not have "settings" key' );
$this->assertArrayHasKey( 'title', $properties, 'Schema properties array does not have "title" key' );
}
}