| @@ -56,15 +56,22 @@ | ||
| 56 | 56 | |
| 57 | 57 | public function getUsers(ManagerService $managerService) |
| 58 | 58 | { |
| 59 | 59 | $search = sanitize_text_field($this->request->get('search', '')); |
| 60 | - | |
| 61 | - $users = get_users([ | |
| 62 | - 'search' => "*{$search}*", | |
| 63 | - 'number' => 50, | |
| 64 | - 'fields' => ['ID', 'display_name', 'user_email'] | |
| 65 | - ]); | |
| 66 | - | |
| 60 | + | |
| 61 | + if (current_user_can('list_users')) { | |
| 62 | + $users = get_users([ | |
| 63 | + 'search' => "*{$search}*", | |
| 64 | + 'number' => 50, | |
| 65 | + 'fields' => ['ID', 'display_name', 'user_email'] | |
| 66 | + ]); | |
| 67 | + } else { | |
| 68 | + // A delegated full-access manager may confirm an address they already know, | |
| 69 | + // but must not browse the site's user roster (FF-SEC-45). | |
| 70 | + $user = is_email($search) ? get_user_by('email', $search) : false; | |
| 71 | + $users = $user ? [$user] : []; | |
| 72 | + } | |
| 73 | + | |
| 67 | 74 | $formattedUsers = []; |
| 68 | 75 | foreach ($users as $user) { |
| 69 | 76 | $formattedUsers[] = [ |
| 70 | 77 | 'ID' => $user->ID, |
