Per the documentation standards, it should not be used outside of the default bundled themes.
Follow-up to [38767], [47055], [49697], [50956], [51003], [52069], [53255].
See #54729.
git-svn-id: https://develop.svn.wordpress.org/trunk@53331 602fd350-edb4-49c9-b593-d223f7449a82
Improve validation of `WP_User_Query`'s `fields` argument when passed as an array to ensure it only accepts permitted values. This prevents the invalid values being included in the generated database query.
Expand unit tests to include passing invalid values as part of an array, the lower case value `id`. Correct earlier unit tests to limit database query to one result.
Follow up to [53255].
Props felipeelia.
Fixes#53177.
git-svn-id: https://develop.svn.wordpress.org/trunk@53327 602fd350-edb4-49c9-b593-d223f7449a82
This change ensures the `fields` parameter is taken into account when running `WP_User_Query` by fixing the conditional statement used to process the `fields` param.
Props rilwis, peterwilsoncc, NomNom99, hellofromTonya, audrasjb, rilwis, Boniu91.
Fixes#53177.
git-svn-id: https://develop.svn.wordpress.org/trunk@53255 602fd350-edb4-49c9-b593-d223f7449a82
Adds a new filter to alter the output of `get_the_author_link`. This change also adds unit tests for the new filter.
Props dshanske, donmhico, audrasjb, peterwilsoncc, SergeyBiryukov.
Fixes#51859.
git-svn-id: https://develop.svn.wordpress.org/trunk@53147 602fd350-edb4-49c9-b593-d223f7449a82
Currently in WordPress multisite there is a concept of large networks. The function `wp_is_large_network` is used to determine if a network has a large number of sites or users. If a network is marked as large, then
expensive queries to calculate user counts are not run on page load but deferred to scheduled events. However there are a number of places in a single site installation where this functionality would also be useful, as
expensive calls to count users and roles can make screens in the admin extremely slow.
In this change, the `get_user_count` function and related functionality around it is ported to be available in a single site context. This means that expensive calls to the `count_users` function are replaced with
calls to `get_user_count`. This change also includes a new function called `wp_is_large_user_count` and a filter of the same name, to mark if a site is large.
Props johnbillion, Spacedmonkey, Mista-Flo, lumpysimon, tharsheblows, obenland, miss_jwo, jrchamp, flixos90, macbookandrew, pento, desrosj, johnjamesjacoby, jb510, davidbaumwald, costdev.
Fixes#38741.
git-svn-id: https://develop.svn.wordpress.org/trunk@53011 602fd350-edb4-49c9-b593-d223f7449a82
This standardizes the actions that one needs to hook to for tracking user role changes:
* `add_user_role` is only fired when the user has actually gained a new role.
* `remove_user_role` is only fired when the role was actually removed.
Both actions are now fired in `WP_User::set_role()` as appropriate.
Props dd32, SergeyBiryukov.
Fixes#54164.
git-svn-id: https://develop.svn.wordpress.org/trunk@52823 602fd350-edb4-49c9-b593-d223f7449a82
This change introduces two new hooks to help developers to filter retrieve password emails:
- `send_retrieve_password_email` can be used to filter whether to send the retrieve password email;
- `retrieve_password_notification_email` can be used to filter the contents of the reset password notification email sent to the user.
This changesets also adds unit tests for these new filters.
Props connapptivity, costdev, audrasjb, johnbillion.
Fixes#54690.
git-svn-id: https://develop.svn.wordpress.org/trunk@52604 602fd350-edb4-49c9-b593-d223f7449a82
Introduces a new function called `wp_list_users()`. Similar to other list functions such as `wp_list_authors()`, it lists all the users of the site. Options are available to configure the HTML output.
Following the same pattern of the other list functions, the list's HTML output is rendered by default. Setting the `echo` argument to `false`, returns the list's HTML output.
A new test class is included.
Props afercia, audrasjb, chriscct7, costdev, desrosj, greenshady, hellofromTonya, mte90, nacin, rohan013, sergeybiryukov.
Fixes#15145.
git-svn-id: https://develop.svn.wordpress.org/trunk@52064 602fd350-edb4-49c9-b593-d223f7449a82
Adds a `public` visibility to test fixtures, tests, data providers, and callbacks methods.
Adds a `private` visibility to helper methods within test classes.
Renames callbacks and helpers that previously started with a `_` prefix. Why? For consistency and to leverage using the method visibility. Further naming standardizations is beyond the scope of this commit.
Props costdev, jrf, hellofromTonya.
Fixes#54177.
git-svn-id: https://develop.svn.wordpress.org/trunk@52010 602fd350-edb4-49c9-b593-d223f7449a82
Similar to the existing `role`/`role__in`/`role__not_in` query arguments, this adds support for three new query arguments in `WP_User_Query`:
* `capability`
* `capability__in`
* `capability__not_in`
These can be used to fetch users with (or without) a specific set of capabilities, for example to get all users
with the capability to edit a certain post type.
Under the hood, this will check all existing roles on the site and perform a `LIKE` query against the `capabilities` user meta field to find:
* all users with a role that has this capability
* all users with the capability being assigned directly
Note: In WordPress, not all capabilities are stored in the database. Capabilities can also be modified using filters like `map_meta_cap`. These new query arguments do NOT work for such capabilities.
The prime use case for capability queries is to get all "authors", i.e. users with the capability to edit a certain post type.
Until now, `'who' => 'authors'` was used for this, which relies on user levels. However, user levels were deprecated a long time ago and thus never added to custom roles. This led to constant frustration due to users with custom roles missing from places like author dropdowns.
This updates any usage of `'who' => 'authors'` in core to use capability queries instead.
Subsequently, `'who' => 'authors'` queries are being **deprecated** in favor of these new query arguments.
Also adds a new `capabilities` parameter (mapping to `capability__in` in `WP_User_Query`) to the REST API users controller.
Also updates `twentyfourteen_list_authors()` in Twenty Fourteen to make use of this new functionality, adding a new `twentyfourteen_list_authors_query_args` filter to make it easier to override this behavior.
Props scribu, lgladdly, boonebgorges, spacedmonkey, peterwilsoncc, SergeyBiryukov, swissspidy.
Fixes#16841.
git-svn-id: https://develop.svn.wordpress.org/trunk@51943 602fd350-edb4-49c9-b593-d223f7449a82
These were originally added in [26252] to suppress database errors on `setUp()` and restore on `tearDown()` for tests that call `wpmu_create_blog()`, blog factory, or installation code that attempts to clear transients.
As the multisite test coverage expanded, these methods ended up being unnecessarily copied into other test classes, where database error suppression is not required.
Follow-up to [26252], [29916], [30286], [33184], [34898], [34899], [34901], [37234], [37477], [37894], [49212], [49616], [51859].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51869 602fd350-edb4-49c9-b593-d223f7449a82
> PHPUnit 8.0.0 introduced a `void` return type declaration to the "fixture" methods – `setUpBeforeClass()`, `setUp()`, `tearDown()` and `tearDownAfterClass()`. As the `void` return type was not introduced until PHP 7.1, this makes it more difficult to create cross-version compatible tests when using fixtures, due to signature mismatches.
>
> The `Yoast\PHPUnitPolyfills\TestCases\TestCase` overcomes the signature mismatch by having two versions. The correct one will be loaded depending on the PHPUnit version being used.
>
> When using this TestCase, if an individual test, or another TestCase which extends this TestCase, needs to overload any of the "fixture" methods, it should do so by using a snake_case variant of the original fixture method name, i.e. `set_up_before_class()`, `set_up()`, `assert_pre_conditions()`, `assert_post_conditions()`, `tear_down()`, and `tear_down_after_class()`.
>
> The snake_case methods will automatically be called by PHPUnit.
>
> > IMPORTANT: The snake_case methods should not call the PHPUnit parent, i.e. do not use `parent::setUp()` from within an overloaded `set_up()` method. If necessary, DO call `parent::set_up()`.
Reference: https://github.com/Yoast/PHPUnit-Polyfills#testcases
This commit renames all declared fixture methods, and calls to parent versions of those fixture methods, from camelCase to snake_case.
Follow-up to [51559-51567].
Props jrf, hellofromTonya, johnbillion, netweb, dd32, pputzer, SergeyBiryukov.
See #46149.
git-svn-id: https://develop.svn.wordpress.org/trunk@51568 602fd350-edb4-49c9-b593-d223f7449a82
Using the `assertContains()` and `assertNotContains()` methods with string haystacks was deprecated in PHPUnit 8 and removed in PHPUnit 9.
While WordPress test suite currently only supports PHPUnit up to 7.5.x, this allows us to switch to newer assertions ahead of adding full support for PHPUnit 8+.
These methods introduced in PHPUnit 7.5 should be used as an alternative:
* `assertStringContainsString()`
* `assertStringContainsStringIgnoringCase`
* `assertStringNotContainsString()`
* `assertStringNotContainsStringIgnoringCase`
As WordPress currently uses PHPUnit 5.7.x to run tests on PHP 5.6, polyfills for these methods were added to the `WP_UnitTestCase` class for PHPUnit < 7.5.
Follow-up to [51331], [51451], [51461].
Props jrf, dd32, SergeyBiryukov.
See #53363, #46149.
git-svn-id: https://develop.svn.wordpress.org/trunk@51462 602fd350-edb4-49c9-b593-d223f7449a82
This replaces instances of `assertTrue( ... > 0 )` with `assertGreaterThan()` to use native PHPUnit functionality.
Follow-up to [51335], [51337], [51367], [51397], [51403], [51404], [51436], [51438], [51448], [51449], [51451], [51453].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51454 602fd350-edb4-49c9-b593-d223f7449a82
This replaces instances of `assertTrue( is_numeric( ... ) )` with `assertIsNumeric()` to use native PHPUnit functionality.
Follow-up to [51335], [51337], [51367], [51397], [51403], [51404], [51436].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51438 602fd350-edb4-49c9-b593-d223f7449a82
This provides a consistent global starting state for tests that interact with admin screens.
Individual tests no longer need to invoke `set_current_screen( 'front' )` (or an alternative implementation) as a reset.
Follow-up to [29251], [29860], [31046], [36721], [38678], [48908], [50433].
Props hellofromTonya, johnbillion.
Fixes#53431.
git-svn-id: https://develop.svn.wordpress.org/trunk@51419 602fd350-edb4-49c9-b593-d223f7449a82
This replaces instances of `assertTrue( isset( ... ) )` with `assertArrayHasKey()` to use native PHPUnit functionality.
Follow-up to [51335], [51337], [51367].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51397 602fd350-edb4-49c9-b593-d223f7449a82
This replaces instances of `assertSame( [number], count( ... ) )` with `assertCount()` to use native PHPUnit functionality.
Follow-up to [51335], [51337].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51367 602fd350-edb4-49c9-b593-d223f7449a82
The `assertInternalType()` and `assertNotInternalType()` methods are deprecated in PHPUnit 8 and removed in PHPUnit 9.
While WordPress test suite currently only supports PHPUnit up to 7.5.x, this allows us to switch to newer assertions ahead of adding full support for PHPUnit 8+.
These methods introduced in PHPUnit 7.5 should be used as an alternative:
* `assertIsArray()`
* `assertIsBool()`
* `assertIsFloat()`
* `assertIsInt()`
* `assertIsNumeric()`
* `assertIsObject()`
* `assertIsResource()`
* `assertIsString()`
* `assertIsScalar()`
* `assertIsCallable()`
* `assertIsIterable()`
* `assertIsNotArray()`
* `assertIsNotBool()`
* `assertIsNotFloat()`
* `assertIsNotInt()`
* `assertIsNotNumeric()`
* `assertIsNotObject()`
* `assertIsNotResource()`
* `assertIsNotString()`
* `assertIsNotScalar()`
* `assertIsNotCallable()`
* `assertIsNotIterable()`
As WordPress currently uses PHPUnit 5.7.x to run tests on PHP 5.6, polyfills for these methods are now added to the `WP_UnitTestCase` class for PHPUnit < 7.5.
Props pbearne, jrf, dd32, SergeyBiryukov.
Fixes#53491. See #46149.
git-svn-id: https://develop.svn.wordpress.org/trunk@51331 602fd350-edb4-49c9-b593-d223f7449a82
Ensure `current_user_can()` and `user_can()` return the same results for logged out users. For core capabilities this changes `user_can( 0, 'exist' )` to return `true` rather than `false` in line with `current_user_can( 'exist' )` for logged out users.
Convert `current_user_can()` and `current_user_can_for_blog()` to wrapper functions ultimately calling `user_can()`.
Add anonymous user to primitive capability checks as appropriate. Convert `Tests_User_Capabilities::test_other_caps_for_all_roles()` to use a data provider and add tests to check whether user exists in the database (`WP_User::exists()`) as that intentionally differs from the `exist` capability.
Props jjj, johnbillion, peterwilsoncc, SergeyBiryukov, TimothyBlynJacobs.
Fixes#52076.
git-svn-id: https://develop.svn.wordpress.org/trunk@50490 602fd350-edb4-49c9-b593-d223f7449a82
Switching a WordPress site from HTTP to HTTPS has historically been a tedious task. While on the surface the Site Address and WordPress Address have to be updated, existing content still remains using HTTP URLs where hard-coded in the database. Furthermore, updating _two_ URLs to migrate to HTTPS is still a fairly unintuitive step which is not clearly explained.
This changeset simplifies migration from HTTP to HTTPS and, where possible, makes it a one-click interaction.
* Automatically replace insecure versions of the Site Address (`home_url()`) with its HTTPS counterpart on the fly if the site has been migrated from HTTP to HTTPS. This is accomplished by introducing a `https_migration_required` option and enabling it when the `home_url()` is accordingly changed.
* A new `wp_replace_insecure_home_url()` function is hooked into various pieces of content to replace URLs accordingly.
* The migration only kicks in when the Site Address (`home_url()`) and WordPress Address (`site_url()`) match, which is the widely common case. Configurations where these differ are often maintained by more advanced users, where this migration routine would be less essential - something to potentially iterate on in the future though.
* The migration does not actually update content in the database. More savvy users that prefer to do that can prevent the migration logic from running by either deleting the `https_migration_required` option or using the new `wp_should_replace_insecure_home_url` filter.
* For fresh sites that do not have any content yet at the point of changing the URLs to HTTPS, the migration will also be skipped since it would not be relevant.
* Expose a primary action in the Site Health recommendation, if HTTPS is already supported by the environment, built on top of the HTTPS detection mechanism from [49904]. When clicked, the default behavior is to update `home_url()` and `site_url()` in one go to their HTTPS counterpart.
* A new `wp_update_urls_to_https()` function takes care of the update routine.
* A new `update_https` meta capability is introduced to control access.
* If the site's URLs are controlled by constants, this update is not automatically possible, so in these scenarios the user is informed about that in the HTTPS status check in Site Health.
* Allow hosting providers to modify the URLs linked to in the HTTPS status check in Site Health, similar to how that is possible for the URLs around updating the PHP version.
* A `WP_UPDATE_HTTPS_URL` environment variable or `wp_update_https_url` filter can be used to provide a custom URL with guidance about updating the site to use HTTPS.
* A `WP_DIRECT_UPDATE_HTTPS_URL` environment variable or `wp_direct_update_https_url` filter can be used to provide a custom URL for the primary CTA to update the site to use HTTPS.
Props flixos90, timothyblynjacobs.
Fixes#51437.
git-svn-id: https://develop.svn.wordpress.org/trunk@50131 602fd350-edb4-49c9-b593-d223f7449a82
Previously, all permission checks for using app passwords were implemented using `edit_user`. This commit introduces a series of more fine grained meta capabilities that should be used instead: `create_app_password`, `list_app_passwords`, `read_app_password`, `edit_app_password`, `delete_app_password` and `delete_app_passwords`. These capabilities all map to `edit_user` by default, but may now be customized by developers.
Props johnbillion, TimothyBlynJacobs.
Fixes#51703.
git-svn-id: https://develop.svn.wordpress.org/trunk@50114 602fd350-edb4-49c9-b593-d223f7449a82
This test previously performed 1,010 assertions, and a failure in any one would prevent the other assertions from running. Using a data provider means simultaneous failures will all be reported at once.
See #51344, #32394
git-svn-id: https://develop.svn.wordpress.org/trunk@49605 602fd350-edb4-49c9-b593-d223f7449a82
The existing assertions were erroneously placed outside the iteration of all users, and therefore were only run against the last user in the list, which is the Subscriber role.
See #51344, #32394
git-svn-id: https://develop.svn.wordpress.org/trunk@49604 602fd350-edb4-49c9-b593-d223f7449a82
This brings consistency to this often-used method, and allows IDEs to provide help to developers when using its `$factory` parameter.
See #51344
git-svn-id: https://develop.svn.wordpress.org/trunk@49603 602fd350-edb4-49c9-b593-d223f7449a82
Using `var` or only `static` to declare a class property is PHP 4 code.
This updates the codebase to use explicit visibility modifiers introduced in PHP 5.
Props jrf.
Fixes#51557. See #22234.
git-svn-id: https://develop.svn.wordpress.org/trunk@49184 602fd350-edb4-49c9-b593-d223f7449a82
This avoids a few PHP notices if the `include_selected` parameter was specified and a non-existing user ID was passed.
Props campusboy1987.
Fixes#51370.
git-svn-id: https://develop.svn.wordpress.org/trunk@49036 602fd350-edb4-49c9-b593-d223f7449a82
These were previously missed due to incorrect capitalization.
Follow-up to [48937], [48939], [48940].
See #38266.
git-svn-id: https://develop.svn.wordpress.org/trunk@48944 602fd350-edb4-49c9-b593-d223f7449a82
This ensures that not only the array values being compared are equal, but also that their type is the same.
These new methods replace most of the existing instances of `assertEqualSets()` and `assertEqualSetsWithIndex()`.
Going forward, stricter type checking by using `assertSameSets()` or `assertSameSetsWithIndex()` should generally be preferred, to make the tests more reliable.
Follow-up to [48937].
See #38266.
git-svn-id: https://develop.svn.wordpress.org/trunk@48939 602fd350-edb4-49c9-b593-d223f7449a82
This ensures that not only the return values match the expected results, but also that their type is the same.
Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable.
Props johnbillion, jrf, SergeyBiryukov.
See #38266.
git-svn-id: https://develop.svn.wordpress.org/trunk@48937 602fd350-edb4-49c9-b593-d223f7449a82
As per the documentation of the `@covers` tag, global functions being covered should be prefixed with `::`. Also, the `()` after the function name is redundant.
Follow-up to [39918].
Props jrf.
See #50267.
git-svn-id: https://develop.svn.wordpress.org/trunk@48848 602fd350-edb4-49c9-b593-d223f7449a82
Declaring a `private` method as `final` is an oxymoron, as `private` methods cannot be overloaded anyway.
Using `final private function...` will generate a warning in PHP 8.
Props jrf.
Fixes#50897.
git-svn-id: https://develop.svn.wordpress.org/trunk@48788 602fd350-edb4-49c9-b593-d223f7449a82
This resolves PHP notices in a few places in core where this capability is checked.
Props Mte90, johnbillion, dipesh.kakadiya, jipmoors, bamadesigner, dd32, johnjamesjacoby, xedin.unknown, flixos90, SergeyBiryukov.
Fixes#30991.
git-svn-id: https://develop.svn.wordpress.org/trunk@47357 602fd350-edb4-49c9-b593-d223f7449a82
Sergey Biryukov