sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Customize: Skip exporting partials to client and handling rendering requests if user can't modify associated settings.

Browse Source 
Introduces `WP_Customize_Partial::check_capabilities()` for parity with `WP_Customize_Control::check_capabilities()`.
 
See #27355.
Fixes #35914.


git-svn-id: https://develop.svn.wordpress.org/trunk@36643 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Weston Ruter 2016-02-23 18:13:30 +00:00
parent 380e94f1ee
commit c9b47e9d92
4 changed files with 68 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/wp-includes/customize/class-wp-customize-partial.php
View File

@ -70,11 +70,11 @@ class WP_Customize_Partial {
public $selector;
/**
* All settings tied to the partial.
* IDs for settings tied to the partial.
*
* @access public
* @since 4.5.0
* @var WP_Customize_Setting[]
* @var array
*/
public $settings;
@ -285,4 +285,26 @@ class WP_Customize_Partial {
);
return $exports;
}
/**
* Checks if the user can refresh this partial.
*
* Returns false if the user cannot manipulate one of the associated settings,
* or if one of the associated settings does not exist.
*
* @since 4.5.0
* @access public
*
* @return bool False if user can't edit one one of the related settings,
* or if one of the associated settings does not exist.
*/
final public function check_capabilities() {
foreach ( $this->settings as $setting_id ) {
$setting = $this->component->manager->get_setting( $setting_id );
if ( ! $setting || ! $setting->check_capabilities() ) {
return false;
}
}
return true;
}
}

6
src/wp-includes/customize/class-wp-customize-selective-refresh.php
View File

@ -172,7 +172,9 @@ final class WP_Customize_Selective_Refresh {
$partials = array();
foreach ( $this->partials() as $partial ) {
$partials[ $partial->id ] = $partial->json();
if ( $partial->check_capabilities() ) {
$partials[ $partial->id ] = $partial->json();
}
}
$exports = array(
@ -356,7 +358,7 @@ final class WP_Customize_Selective_Refresh {
$partial = $this->get_partial( $partial_id );
if ( ! $partial ) {
if ( ! $partial || ! $partial->check_capabilities() ) {
$contents[ $partial_id ] = null;
continue;
}

29
tests/phpunit/tests/customize/partial.php
View File

@ -273,7 +273,7 @@ class Test_WP_Customize_Partial extends WP_UnitTestCase {
}
/**
* Test WP_Customize_Partial::json() default.
* Test WP_Customize_Partial::json().
*
* @see WP_Customize_Partial::json()
*/
@ -300,6 +300,33 @@ class Test_WP_Customize_Partial extends WP_UnitTestCase {
$this->assertArrayHasKey( 'containerInclusive', $exported );
}
/**
* Test WP_Customize_Partial::check_capabilities().
*
* @see WP_Customize_Partial::check_capabilities()
*/
function test_check_capabilities() {
wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
do_action( 'customize_register', $this->wp_customize );
$partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
'settings' => array( 'blogname' ),
) );
$this->assertTrue( $partial->check_capabilities() );
$partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
'settings' => array( 'blogname', 'non_existing' ),
) );
$this->assertFalse( $partial->check_capabilities() );
$this->wp_customize->add_setting( 'top_secret_message', array(
'capability' => 'top_secret_clearance',
) );
$partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array(
'settings' => array( 'blogname', 'top_secret_clearance' ),
) );
$this->assertFalse( $partial->check_capabilities() );
}
/**
* Tear down.
*/

12
tests/phpunit/tests/customize/selective-refresh.php
View File

@ -137,9 +137,20 @@ class Test_WP_Customize_Selective_Refresh extends WP_UnitTestCase {
* @see WP_Customize_Selective_Refresh::export_preview_data()
*/
function test_export_preview_data() {
$user_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
wp_set_current_user( $user_id );
$user = new WP_User( $user_id );
do_action( 'customize_register', $this->wp_customize );
$user->remove_cap( 'top_secret_clearance' );
$this->wp_customize->add_setting( 'top_secret_message', array(
'capability' => 'top_secret_clearance', // The administrator role lacks this.
) );
$this->selective_refresh->add_partial( 'blogname', array(
'selector' => '#site-title',
) );
$this->selective_refresh->add_partial( 'top_secret_message', array(
'settings' => array( 'top_secret_message' ),
) );
ob_start();
$this->selective_refresh->export_preview_data();
$html = ob_get_clean();
@ -149,6 +160,7 @@ class Test_WP_Customize_Selective_Refresh extends WP_UnitTestCase {
$this->assertArrayHasKey( 'partials', $exported_data );
$this->assertInternalType( 'array', $exported_data['partials'] );
$this->assertArrayHasKey( 'blogname', $exported_data['partials'] );
$this->assertArrayNotHasKey( 'top_secret_message', $exported_data['partials'] );
$this->assertEquals( '#site-title', $exported_data['partials']['blogname']['selector'] );
$this->assertArrayHasKey( 'renderQueryVar', $exported_data );
$this->assertArrayHasKey( 'l10n', $exported_data );