From c89822ebe0e9e3415527d754e5316fcd6d5f1948 Mon Sep 17 00:00:00 2001 From: Jeremy Felt Date: Thu, 10 Sep 2015 03:20:11 +0000 Subject: [PATCH] Multisite: Test `edit_user` capabilities for multisite administrators An administrator in multisite can not edit users other than itself. Props daniellandau for the initial patch. See #16860. git-svn-id: https://develop.svn.wordpress.org/trunk@33987 602fd350-edb4-49c9-b593-d223f7449a82 --- tests/phpunit/tests/user/capabilities.php | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/tests/phpunit/tests/user/capabilities.php b/tests/phpunit/tests/user/capabilities.php index 886588341c..4fc7ecd32b 100644 --- a/tests/phpunit/tests/user/capabilities.php +++ b/tests/phpunit/tests/user/capabilities.php @@ -936,4 +936,31 @@ class Tests_User_Capabilities extends WP_UnitTestCase { $this->assertFalse( current_user_can( 'edit_post', $post ) ); $this->assertFalse( current_user_can( 'edit_post', $post + 1 ) ); } + + function test_multisite_administrator_can_not_edit_users() { + if ( ! is_multisite() ) { + $this->markTestSkipped( 'Test only runs in multisite' ); + return; + } + + $user = new WP_User( $this->factory->user->create( array( 'role' => 'administrator' ) ) ); + $other_user = new WP_User( $this->factory->user->create( array( 'role' => 'subscriber' ) ) ); + + wp_set_current_user( $user->ID ); + + $this->assertFalse( current_user_can( 'edit_user', $other_user->ID ) ); + } + + function test_multisite_user_can_edit_self() { + if ( ! is_multisite() ) { + $this->markTestSkipped( 'Test only runs in multisite' ); + return; + } + + $user = new WP_User( $this->factory->user->create( array( 'role' => 'administrator' ) ) ); + + wp_set_current_user( $user->ID ); + + $this->assertTrue( current_user_can( 'edit_user', $user->ID ) ); + } }