Commit Graph

28 Commits

Author SHA1 Message Date
John Blackbourn
6c79b715bd Role/Capability: Add create_sites and delete_sites to the list of capabilities that are checked as part of the comporehensive roles and capabilities tests.
See #32394, #36413


git-svn-id: https://develop.svn.wordpress.org/trunk@37157 602fd350-edb4-49c9-b593-d223f7449a82
2016-04-04 22:29:55 +00:00
John Blackbourn
b637e77c5a Tests: Fix all the things.
See #30017, #32394


git-svn-id: https://develop.svn.wordpress.org/trunk@36049 602fd350-edb4-49c9-b593-d223f7449a82
2015-12-21 07:09:43 +00:00
John Blackbourn
8567d80ade Tests: Shave a second off the user capability tests by reusing its user fixtures.
See #30017, #32394


git-svn-id: https://develop.svn.wordpress.org/trunk@36047 602fd350-edb4-49c9-b593-d223f7449a82
2015-12-21 06:56:57 +00:00
johnbillion
3348774d3a Ensure that all the capabilities that any users have are being tested. This ensures that if new capabilities are introduced in the future, tests will be required for them.
See #35024


git-svn-id: https://develop.svn.wordpress.org/trunk@35872 602fd350-edb4-49c9-b593-d223f7449a82
2015-12-11 21:59:01 +00:00
John Blackbourn
a7f713f45d Introduce tests for the unfiltered_upload capability, which no user should have (unless the ALLOW_UNFILTERED_UPLOADS constant is defined).
See #35024


git-svn-id: https://develop.svn.wordpress.org/trunk@35871 602fd350-edb4-49c9-b593-d223f7449a82
2015-12-11 21:54:05 +00:00
John Blackbourn
e76be26406 Add assertions for role names as capabilities in the capabilities tests. This ensures the role name is only available as a capability to the corresponding role.
See #35007


git-svn-id: https://develop.svn.wordpress.org/trunk@35863 602fd350-edb4-49c9-b593-d223f7449a82
2015-12-11 11:06:28 +00:00
John Blackbourn
da2acf666a When a post is scheduled for publication, treat it the same as a published post when calculating the capabilities required to edit or delete it.
Fixes #33694


git-svn-id: https://develop.svn.wordpress.org/trunk@35747 602fd350-edb4-49c9-b593-d223f7449a82
2015-11-29 02:24:15 +00:00
Scott Taylor
b757b37551 Unit Tests: after [35225], make factory a method/getter on WP_UnitTestCase and add magic methods for BC for every plugin that is extending WP_UnitTestCase and accessing the $factory instance prop.
Props nerrad, wonderboymusic.
See #30017, #33968.



git-svn-id: https://develop.svn.wordpress.org/trunk@35242 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-17 18:02:16 +00:00
Scott Taylor
e70ebea219 Unit Tests: one $factory to rule them all, and it shall be static.
Using more than one instance of `WP_UnitTest_Factory` causes all kinds of craziness, due to out-of-sync internal generator sequences. Since we want to use `setUpBeforeClass`, we were creating ad hoc instances. To avoid that, we were injecting one `static` instance via Dependency Injection in `wpSetUpBeforeClass`. All tests should really use the `static` instance, so we will remove the instance prop `$factory`.

Replace `$this->factory` with `self::$factory` over 2000 times.
Rewrite all of the tests that were hard-coding dynamic values. 

#YOLOFriday



git-svn-id: https://develop.svn.wordpress.org/trunk@35225 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-16 21:04:12 +00:00
Boone Gorges
578134d4ff Use wp_installing() instead of WP_INSTALLING constant.
The `WP_INSTALLING` constant is a flag that WordPress sets in a number of
places, telling the system that options should be fetched directly from the
database instead of from the cache, that WP should not ping wordpress.org for
updates, that the normal "not installed" checks should be bypassed, and so on.

A constant is generally necessary for this purpose, because the flag is
typically set before the WP bootstrap, meaning that WP functions are not yet
available.  However, it is possible - notably, during `wpmu_create_blog()` -
for the "installing" flag to be set after WP has already loaded. In these
cases, `WP_INSTALLING` would be set for the remainder of the process, since
there's no way to change a constant once it's defined. This, in turn, polluted
later function calls that ought to have been outside the scope of site
creation, particularly the non-caching of option data. The problem was
particularly evident in the case of the automated tests, where `WP_INSTALLING`
was set the first time a site was created, and remained set for the rest of the
suite.

The new `wp_installing()` function allows developers to fetch the current
installation status (when called without any arguments) or to set the
installation status (when called with a boolean `true` or `false`). Use of
the `WP_INSTALLING` constant is still supported; `wp_installing()` will default
to `true` if the constant is defined during the bootstrap.

Props boonebgorges, jeremyfelt.
See #31130.

git-svn-id: https://develop.svn.wordpress.org/trunk@34828 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-05 15:05:26 +00:00
John Blackbourn
9dd4680d2f Add tests for some missing capabilities, including do_not_allow.
See #32394.


git-svn-id: https://develop.svn.wordpress.org/trunk@34450 602fd350-edb4-49c9-b593-d223f7449a82
2015-09-22 22:17:30 +00:00
John Blackbourn
f1191d2e6e Correct a capability name in the roles and capabilities mapping. The delete_others_pages key was missing, and the delete_others_posts key was duplicated.
Introduced in [32812].

See #32394.


git-svn-id: https://develop.svn.wordpress.org/trunk@34449 602fd350-edb4-49c9-b593-d223f7449a82
2015-09-22 22:15:18 +00:00
johnbillion
50226ada19 Implement a test for capabilities for a custom post type that uses capability_type => page.
See #17253


git-svn-id: https://develop.svn.wordpress.org/trunk@34447 602fd350-edb4-49c9-b593-d223f7449a82
2015-09-22 21:00:03 +00:00
Boone Gorges
829ae5f4ce Fail gracefully when checking mapped cap against unregistered post type.
Post type objects are reponsible for mapping their capabilities to core caps.
As a result, when the post type is no longer registered, the caps are no
longer mapped. This causes problems when a post is left in the database after
the post type is no longer present, and WP does an 'edit_post' or other cap
check against it: a PHP notice is thrown, and the cap check always fails.

As a more graceful fallback, we map all post-type-dependent caps onto
'edit_others_posts', which allows highly privileged users to be able to
access orphaned content (such as comments belonging to disabled post types),
while minimizing the possibility of unintended privilege escalation.

We also add a `_doing_it_wrong()` notice, so that developers and site
administrators are aware that the cap mapping is failing in the absence of
the registered post type.

Props mitchoyoshitaka, DrewAPicture, imath, codeelite, boonebgorges, nofearinc, SergeyBiryukov, jorbin, dlh.
Fixes #16956.

git-svn-id: https://develop.svn.wordpress.org/trunk@34091 602fd350-edb4-49c9-b593-d223f7449a82
2015-09-12 21:26:57 +00:00
Jeremy Felt
ef1f697564 Multisite: Allow users with manage_network_users to edit network users.
Other users in a network can now be given capabilities to manage users without also having global super admin privileges.

* Users with `manage_network_users` can not edit super admins.
* Users with `manage_network_users` can not promote users to super admin.
* Uses of `is_super_admin()` in `user-new.php` are now updated to `manage_network_users`.

Props daniellandau, chriscct7.
Fixes #16860.


git-svn-id: https://develop.svn.wordpress.org/trunk@33988 602fd350-edb4-49c9-b593-d223f7449a82
2015-09-10 03:33:22 +00:00
Jeremy Felt
c89822ebe0 Multisite: Test edit_user capabilities for multisite administrators
An administrator in multisite can not edit users other than itself.

Props daniellandau for the initial patch.
See #16860.


git-svn-id: https://develop.svn.wordpress.org/trunk@33987 602fd350-edb4-49c9-b593-d223f7449a82
2015-09-10 03:20:11 +00:00
Gary Pendergast
7439dd7354 Capabilities: When creating an auto-draft, ensure that the current user still has permission to do so.
git-svn-id: https://develop.svn.wordpress.org/trunk@33357 602fd350-edb4-49c9-b593-d223f7449a82
2015-07-22 04:01:53 +00:00
John Blackbourn
afd6dd79fe Comprehensive unit tests for every available capability, and for all roles.
Fixes #32394.


git-svn-id: https://develop.svn.wordpress.org/trunk@32812 602fd350-edb4-49c9-b593-d223f7449a82
2015-06-17 00:04:08 +00:00
Gary Pendergast
8453d41a44 Fix the unit test added in [32173] to run correctly in PHP 5.2.
git-svn-id: https://develop.svn.wordpress.org/trunk@32177 602fd350-edb4-49c9-b593-d223f7449a82
2015-04-20 09:40:11 +00:00
Gary Pendergast
94f02ef8b1 In Multisite, prevent plugins from unintentionally switching sites.
Props mdawaffe.



git-svn-id: https://develop.svn.wordpress.org/trunk@32173 602fd350-edb4-49c9-b593-d223f7449a82
2015-04-20 07:26:05 +00:00
Scott Taylor
bcc7f9e093 In WP_User, ->get_role_caps() and ->update_user_level_from_caps() must be called inside ->add_cap() and ->remove_cap() after updating user meta. ->has_cap() checks are currently failing directly after calling ->add_cap().
Adds unit test.

Props rachelbaker.
Fixes #28374.


git-svn-id: https://develop.svn.wordpress.org/trunk@31190 602fd350-edb4-49c9-b593-d223f7449a82
2015-01-16 01:48:36 +00:00
Andrew Nacin
5edec1d792 Don't default to current user for capability checks when dealing with a post without an author (post_author = 0).
Undoes [12053]. While it risks breakage, this is a far safer and saner default for these situations.

props danielbachhuber.
fixes #27020.


git-svn-id: https://develop.svn.wordpress.org/trunk@27390 602fd350-edb4-49c9-b593-d223f7449a82
2014-03-04 03:08:54 +00:00
Andrew Nacin
4c8f1e263a Use @expectedDeprecated. see #25282, [25408].
git-svn-id: https://develop.svn.wordpress.org/trunk@25409 602fd350-edb4-49c9-b593-d223f7449a82
2013-09-12 18:37:32 +00:00
Scott Taylor
654d07ebf9 There was way too much duplicated code in my notice cleanup, it built up over time, and there's definitely a need to standardize.
* Remove duplicated code for deprecated function notice suppression
* Add support in `WP_UnitTestCase` setUp/tearDown methods for `$deprecated_functions` fixture if the extending class has added it
* Add a `$deprecated_functions` fixture to each extending class that needs it

To use this fixture, add something to your Test Case class like so:
`protected $deprecated_functions = array( 'get_theme', 'get_themes', 'get_theme_data', 'get_current_theme' );`

See #25282.



git-svn-id: https://develop.svn.wordpress.org/trunk@25402 602fd350-edb4-49c9-b593-d223f7449a82
2013-09-12 14:47:58 +00:00
Scott Taylor
c0c3359572 * Suppress deprecated function notice for set_current_user()
* Add assertions for `wp_set_current_user()`

See #25282.



git-svn-id: https://develop.svn.wordpress.org/trunk@25391 602fd350-edb4-49c9-b593-d223f7449a82
2013-09-12 06:06:07 +00:00
Scott Taylor
135198d66d Use get_users() instead of the deprecated get_users_of_blog() in Tests_User_Capabilities::setUp() to avoid a tornado of warnings in debug mode.
See #25282.



git-svn-id: https://develop.svn.wordpress.org/trunk@25353 602fd350-edb4-49c9-b593-d223f7449a82
2013-09-11 17:55:12 +00:00
Scott Taylor
16ef2c2e36 Remove lingering instances of call time pass-by-reference, limited to instances of callable - use $this instead of &$this.
Props jdgrimes.
See #25160.



git-svn-id: https://develop.svn.wordpress.org/trunk@25254 602fd350-edb4-49c9-b593-d223f7449a82
2013-09-05 16:33:50 +00:00
Andrew Nacin
8045afd81b Move PHPUnit tests into a tests/phpunit directory.
wp-tests-config.php can/should reside in the root of a develop checkout. `phpunit` should be run from the root.

see #25088.


git-svn-id: https://develop.svn.wordpress.org/trunk@25165 602fd350-edb4-49c9-b593-d223f7449a82
2013-08-29 18:39:34 +00:00