← All changes
|
json-endpoints/class.wpcom-json-api-site-user-endpoint.php
+9
-3
13.6.2
→
16.3-a.1
View file →
| @@ -1,6 +1,10 @@ | ||
| 1 | 1 | <?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName |
| 2 | 2 | |
| 3 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 4 | + exit( 0 ); | |
| 5 | +} | |
| 6 | + | |
| 3 | 7 | new WPCOM_JSON_API_Site_User_Endpoint( |
| 4 | 8 | array( |
| 5 | 9 | 'description' => 'Get details of a user of a site by ID.', |
| 6 | 10 | 'group' => '__do_not_document', // 'users' |
| @@ -106,8 +110,10 @@ | ||
| 106 | 110 | /** |
| 107 | 111 | * Site user endpoint class. |
| 108 | 112 | * |
| 109 | 113 | * /sites/%s/users/%d -> $blog_id, $user_id |
| 114 | + * | |
| 115 | + * @phan-constructor-used-for-side-effects | |
| 110 | 116 | */ |
| 111 | 117 | class WPCOM_JSON_API_Site_User_Endpoint extends WPCOM_JSON_API_Endpoint { |
| 112 | 118 | |
| 113 | 119 | /** |
| @@ -143,9 +149,9 @@ | ||
| 143 | 149 | $blog_id = $this->api->switch_to_blog_and_validate_user( $this->api->get_blog_id( $blog_id ) ); |
| 144 | 150 | if ( is_wp_error( $blog_id ) ) { |
| 145 | 151 | return $blog_id; |
| 146 | 152 | } |
| 147 | - if ( ! current_user_can_for_blog( $blog_id, 'list_users' ) ) { | |
| 153 | + if ( ! current_user_can_for_site( $blog_id, 'list_users' ) ) { | |
| 148 | 154 | return new WP_Error( 'unauthorized', 'User cannot view users for specified site', 403 ); |
| 149 | 155 | } |
| 150 | 156 | |
| 151 | 157 | // Get the user by ID or login |
| @@ -162,9 +168,9 @@ | ||
| 162 | 168 | |
| 163 | 169 | if ( 'GET' === $this->api->method ) { |
| 164 | 170 | return $this->get_user( $user->ID ); |
| 165 | 171 | } elseif ( 'POST' === $this->api->method ) { |
| 166 | - if ( ! current_user_can_for_blog( $blog_id, 'promote_users' ) ) { | |
| 172 | + if ( ! current_user_can_for_site( $blog_id, 'promote_users' ) ) { | |
| 167 | 173 | return new WP_Error( 'unauthorized_no_promote_cap', 'User cannot promote users for specified site', 403 ); |
| 168 | 174 | } |
| 169 | 175 | return $this->update_user( $user_id, $blog_id ); |
| 170 | 176 | } else { |
| @@ -210,9 +216,9 @@ | ||
| 210 | 216 | return new WP_Error( 'unauthorized', 'You cannot change your own role', 403 ); |
| 211 | 217 | } |
| 212 | 218 | |
| 213 | 219 | if ( $is_wpcom && $user_id !== get_current_user_id() && (int) $user_id === wpcom_get_blog_owner( $blog_id ) ) { |
| 214 | - return new WP_Error( 'unauthorized_edit_owner', 'Current user can not edit blog owner', 403 ); | |
| 220 | + return new WP_Error( 'unauthorized_edit_owner', 'Current user cannot edit blog owner', 403 ); | |
| 215 | 221 | } |
| 216 | 222 | |
| 217 | 223 | if ( ! $is_wpcom ) { |
| 218 | 224 | foreach ( $input as $key => $value ) { |