Changeset 60491

Timestamp:

07/21/2025 05:58:11 PM (3 months ago)

Author:

SergeyBiryukov

Message:

Role/Capability: Ensure that logged-out users cannot edit themselves.

Follow-up to [3846], [6697], [14189], [21152].

Props dd32, peterwilsoncc, johnbillion, mukesh27, swissspidy, SergeyBiryukov.
Fixes #63684.

Location:

trunk

Files:

• src/wp-includes/capabilities.php (modified) (1 diff)
• tests/phpunit/tests/user/capabilities.php (modified) (1 diff)

trunk/src/wp-includes/capabilities.php

@@ -61 +61 @@
         case 'edit_user':
         case 'edit_users':
+            // Non-existent users can't edit users, not even themselves.
+            if ( $user_id < 1 ) {
+                $caps[] = 'do_not_allow';
+                break;
+            }
+
             // Allow user to edit themselves.
             if ( 'edit_user' === $cap && isset( $args[0] ) && $user_id === (int) $args[0] ) {

trunk/tests/phpunit/tests/user/capabilities.php

@@ -1831 +1831 @@
     }
 
-    public function test_user_can_edit_self() {
-        foreach ( self::$users as $role => $user ) {
-            wp_set_current_user( $user->ID );
-            $this->assertTrue( current_user_can( 'edit_user', $user->ID ), "User with role {$role} should have the capability to edit their own profile" );
-        }
+    /**
+     * Test if a user can edit their own profile based on their role.
+     *
+     * @ticket 63684
+     *
+     * @dataProvider data_user_can_edit_self
+     *
+     * @param string $role          The role of the user.
+     * @param bool   $can_edit_self Whether the user can edit their own profile.
+     */
+    public function test_user_can_edit_self( $role, $can_edit_self = true ) {
+        $user = self::$users[ $role ];
+        wp_set_current_user( $user->ID );
+
+        if ( $can_edit_self ) {
+            $this->assertTrue(
+                current_user_can( 'edit_user', $user->ID ),
+                "User with role '{$role}' should have the capability to edit their own profile"
+            );
+        } else {
+            $this->assertFalse(
+                current_user_can( 'edit_user', $user->ID ),
+                "User with role '{$role}' should not have the capability to edit their own profile"
+            );
+        }
+    }
+
+    /**
+     * Data provider for test_user_can_edit_self.
+     *
+     * @return array[] Data provider.
+     */
+    public static function data_user_can_edit_self() {
+        return array(
+            'anonymous'     => array( 'anonymous', false ),
+            'administrator' => array( 'administrator', true ),
+            'editor'        => array( 'editor', true ),
+            'author'        => array( 'author', true ),
+            'contributor'   => array( 'contributor', true ),
+            'subscriber'    => array( 'subscriber', true ),
+        );
     }