← All changes | json-endpoints/class.wpcom-json-api-update-user-endpoint.php +20 -13 13.3.3 → 16.3-a.1 View file →

		@@ -4,8 +4,12 @@
4	4	*
5	5	* Endpoint: /sites/%s/users/%d/delete
6	6	*/
7	7
	8	+if ( ! defined( 'ABSPATH' ) ) {
	9	+ exit( 0 );
	10	+}
	11	+
8	12	new WPCOM_JSON_API_Update_User_Endpoint(
9	13	array(
10	14	'description' => 'Deletes or removes a user of a site.',
11	15	'group' => 'users',
		@@ -41,8 +45,10 @@
41	45	);
42	46
43	47	/**
44	48	* Update site users API class.
	49	+ *
	50	+ * @phan-constructor-used-for-side-effects
45	51	*/
46	52	class WPCOM_JSON_API_Update_User_Endpoint extends WPCOM_JSON_API_Endpoint {
47	53	/**
48	54	* Update site users API callback.
		@@ -58,9 +64,9 @@
58	64	}
59	65
60	66	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
61	67	if ( (int) wpcom_get_blog_owner( $blog_id ) === (int) $user_id ) {
62		- return new WP_Error( 'forbidden', 'A site owner can not be removed through this endpoint.', 403 );
	68	+ return new WP_Error( 'forbidden', 'A site owner cannot be removed through this endpoint.', 403 );
63	69	}
64	70	}
65	71
66	72	if ( $this->api->ends_with( $path, '/delete' ) ) {
		@@ -133,12 +139,8 @@
133	139	return $error;
134	140	}
135	141	}
136	142
137		- if ( get_current_user_id() === (int) $user_id ) {
138		- return new WP_Error( 'invalid_input', 'User can not remove or delete self through this endpoint.', 400 );
139		- }
140		-
141	143	if ( ! $this->user_exists( $user_id ) ) {
142	144	return new WP_Error( 'invalid_input', 'A user does not exist with that ID.', 400 );
143	145	}
144	146
		@@ -151,9 +153,10 @@
151	153	* @param int $user_id User ID.
152	154	* @return array|WP_Error
153	155	*/
154	156	public function remove_user( $user_id ) {
155		- if ( ! current_user_can( 'remove_users' ) ) {
	157	+ // Skip the check if the user is removing themselves.
	158	+ if ( ! current_user_can( 'remove_users' ) && get_current_user_id() !== (int) $user_id ) {
156	159	return new WP_Error( 'unauthorized', 'User cannot remove users for specified site.', 403 );
157	160	}
158	161
159	162	if ( ! is_user_member_of_blog( $user_id, get_current_blog_id() ) ) {
		@@ -171,25 +174,29 @@
171	174	* @param int $user_id User ID.
172	175	* @return array|WP_Error
173	176	*/
174	177	public function delete_user( $user_id ) {
175		- if ( ! current_user_can( 'delete_users' ) ) {
	178	+ // Skip the check if the user is deleting themselves.
	179	+ if ( ! current_user_can( 'delete_users' ) && get_current_user_id() !== (int) $user_id ) {
176	180	return new WP_Error( 'unauthorized', 'User cannot delete users for specified site.', 403 );
177	181	}
178	182
179		- $input = (array) $this->input();
	183	+ $input = (array) $this->input();
	184	+ $reassign = isset( $input['reassign'] ) ? (int) $input['reassign'] : null;
180	185
181		- if ( isset( $input['reassign'] ) ) {
182		- if ( (int) $user_id === (int) $input['reassign'] ) {
183		- return new WP_Error( 'invalid_input', 'Can not reassign posts to user being deleted.', 400 );
	186	+ if ( $reassign !== null ) {
	187	+ if ( (int) $user_id === $reassign ) {
	188	+ return new WP_Error( 'invalid_input', 'Cannot reassign posts to user being deleted.', 400 );
184	189	}
185	190
186		- if ( ! $this->user_exists( $input['reassign'] ) ) {
	191	+ if ( ! $this->user_exists( $reassign ) ) {
187	192	return new WP_Error( 'invalid_input', 'User specified in reassign argument is not a member of the specified site.', 400 );
188	193	}
189	194	}
190	195
	196	+ $success = $reassign !== null ? wp_delete_user( $user_id, $reassign ) : wp_delete_user( $user_id );
	197	+
191	198	return array(
192		- 'success' => wp_delete_user( $user_id, (int) $input['reassign'] ),
	199	+ 'success' => $success,
193	200	);
194	201	}
195	202	}