Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-11-05 02:10:45 +01:00
Code Issues Projects Releases Wiki Activity

REST API: Do not allow access to users from a different site in multisite.

Browse Source 
It has been unintendedly possible to both view and edit users from a different site than the current site in multisite environments. Moreover, when passing roles to a user in an update request, that user would implicitly be added to the current site.

This changeset removes the incorrect behavior for now in order to be able to provide a proper REST API workflow for managing multisite users in the near future. Related unit tests have been adjusted as well.

Props jnylen0, jeremyfelt, johnjamesjacoby.
Fixes #39701.

Built from https://develop.svn.wordpress.org/trunk@40106


git-svn-id: http://core.svn.wordpress.org/trunk@40043 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Felix Arntz 2017-02-23 22:37:44 +00:00
parent 7d421b2042
commit eb8457d3f4
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php
View File

@ -351,6 +351,10 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
return $error; return $error;
} }
if ( is_multisite() && ! is_user_member_of_blog( $user->ID ) ) {
return $error;
}
return $user; return $user;
} }
@ -639,10 +643,6 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
/** This action is documented in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php */ /** This action is documented in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php */
do_action( 'rest_insert_user', $user, $request, false ); do_action( 'rest_insert_user', $user, $request, false );
if ( is_multisite() && ! is_user_member_of_blog( $id ) ) {
add_user_to_blog( get_current_blog_id(), $id, '' );
}
if ( ! empty( $request['roles'] ) ) { if ( ! empty( $request['roles'] ) ) {
array_map( array( $user, 'add_role' ), $request['roles'] ); array_map( array( $user, 'add_role' ), $request['roles'] );
} }

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '4.8-alpha-40105'; $wp_version = '4.8-alpha-40106';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.