From c9b47e9d92fbb537611e29b5972e0388bbdecbc3 Mon Sep 17 00:00:00 2001 From: Weston Ruter Date: Tue, 23 Feb 2016 18:13:30 +0000 Subject: [PATCH] Customize: Skip exporting partials to client and handling rendering requests if user can't modify associated settings. Introduces `WP_Customize_Partial::check_capabilities()` for parity with `WP_Customize_Control::check_capabilities()`. See #27355. Fixes #35914. git-svn-id: https://develop.svn.wordpress.org/trunk@36643 602fd350-edb4-49c9-b593-d223f7449a82 --- .../customize/class-wp-customize-partial.php | 26 +++++++++++++++-- .../class-wp-customize-selective-refresh.php | 6 ++-- tests/phpunit/tests/customize/partial.php | 29 ++++++++++++++++++- .../tests/customize/selective-refresh.php | 12 ++++++++ 4 files changed, 68 insertions(+), 5 deletions(-) diff --git a/src/wp-includes/customize/class-wp-customize-partial.php b/src/wp-includes/customize/class-wp-customize-partial.php index f6e5e44565..3cb410b078 100644 --- a/src/wp-includes/customize/class-wp-customize-partial.php +++ b/src/wp-includes/customize/class-wp-customize-partial.php @@ -70,11 +70,11 @@ class WP_Customize_Partial { public $selector; /** - * All settings tied to the partial. + * IDs for settings tied to the partial. * * @access public * @since 4.5.0 - * @var WP_Customize_Setting[] + * @var array */ public $settings; @@ -285,4 +285,26 @@ class WP_Customize_Partial { ); return $exports; } + + /** + * Checks if the user can refresh this partial. + * + * Returns false if the user cannot manipulate one of the associated settings, + * or if one of the associated settings does not exist. + * + * @since 4.5.0 + * @access public + * + * @return bool False if user can't edit one one of the related settings, + * or if one of the associated settings does not exist. + */ + final public function check_capabilities() { + foreach ( $this->settings as $setting_id ) { + $setting = $this->component->manager->get_setting( $setting_id ); + if ( ! $setting || ! $setting->check_capabilities() ) { + return false; + } + } + return true; + } } diff --git a/src/wp-includes/customize/class-wp-customize-selective-refresh.php b/src/wp-includes/customize/class-wp-customize-selective-refresh.php index bf8a9e3c8e..23bf06d7f4 100644 --- a/src/wp-includes/customize/class-wp-customize-selective-refresh.php +++ b/src/wp-includes/customize/class-wp-customize-selective-refresh.php @@ -172,7 +172,9 @@ final class WP_Customize_Selective_Refresh { $partials = array(); foreach ( $this->partials() as $partial ) { - $partials[ $partial->id ] = $partial->json(); + if ( $partial->check_capabilities() ) { + $partials[ $partial->id ] = $partial->json(); + } } $exports = array( @@ -356,7 +358,7 @@ final class WP_Customize_Selective_Refresh { $partial = $this->get_partial( $partial_id ); - if ( ! $partial ) { + if ( ! $partial || ! $partial->check_capabilities() ) { $contents[ $partial_id ] = null; continue; } diff --git a/tests/phpunit/tests/customize/partial.php b/tests/phpunit/tests/customize/partial.php index 6120355da1..9b08fc1230 100644 --- a/tests/phpunit/tests/customize/partial.php +++ b/tests/phpunit/tests/customize/partial.php @@ -273,7 +273,7 @@ class Test_WP_Customize_Partial extends WP_UnitTestCase { } /** - * Test WP_Customize_Partial::json() default. + * Test WP_Customize_Partial::json(). * * @see WP_Customize_Partial::json() */ @@ -300,6 +300,33 @@ class Test_WP_Customize_Partial extends WP_UnitTestCase { $this->assertArrayHasKey( 'containerInclusive', $exported ); } + /** + * Test WP_Customize_Partial::check_capabilities(). + * + * @see WP_Customize_Partial::check_capabilities() + */ + function test_check_capabilities() { + wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) ); + do_action( 'customize_register', $this->wp_customize ); + $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array( + 'settings' => array( 'blogname' ), + ) ); + $this->assertTrue( $partial->check_capabilities() ); + + $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array( + 'settings' => array( 'blogname', 'non_existing' ), + ) ); + $this->assertFalse( $partial->check_capabilities() ); + + $this->wp_customize->add_setting( 'top_secret_message', array( + 'capability' => 'top_secret_clearance', + ) ); + $partial = new WP_Customize_Partial( $this->selective_refresh, 'blogname', array( + 'settings' => array( 'blogname', 'top_secret_clearance' ), + ) ); + $this->assertFalse( $partial->check_capabilities() ); + } + /** * Tear down. */ diff --git a/tests/phpunit/tests/customize/selective-refresh.php b/tests/phpunit/tests/customize/selective-refresh.php index de56b13716..73e7dc36eb 100644 --- a/tests/phpunit/tests/customize/selective-refresh.php +++ b/tests/phpunit/tests/customize/selective-refresh.php @@ -137,9 +137,20 @@ class Test_WP_Customize_Selective_Refresh extends WP_UnitTestCase { * @see WP_Customize_Selective_Refresh::export_preview_data() */ function test_export_preview_data() { + $user_id = self::factory()->user->create( array( 'role' => 'administrator' ) ); + wp_set_current_user( $user_id ); + $user = new WP_User( $user_id ); + do_action( 'customize_register', $this->wp_customize ); + $user->remove_cap( 'top_secret_clearance' ); + $this->wp_customize->add_setting( 'top_secret_message', array( + 'capability' => 'top_secret_clearance', // The administrator role lacks this. + ) ); $this->selective_refresh->add_partial( 'blogname', array( 'selector' => '#site-title', ) ); + $this->selective_refresh->add_partial( 'top_secret_message', array( + 'settings' => array( 'top_secret_message' ), + ) ); ob_start(); $this->selective_refresh->export_preview_data(); $html = ob_get_clean(); @@ -149,6 +160,7 @@ class Test_WP_Customize_Selective_Refresh extends WP_UnitTestCase { $this->assertArrayHasKey( 'partials', $exported_data ); $this->assertInternalType( 'array', $exported_data['partials'] ); $this->assertArrayHasKey( 'blogname', $exported_data['partials'] ); + $this->assertArrayNotHasKey( 'top_secret_message', $exported_data['partials'] ); $this->assertEquals( '#site-title', $exported_data['partials']['blogname']['selector'] ); $this->assertArrayHasKey( 'renderQueryVar', $exported_data ); $this->assertArrayHasKey( 'l10n', $exported_data );