Changeset 14034

Timestamp:

10/02/2024 03:23:39 AM (2 years ago)

Author:

espellcaste

Message:

BP REST API: spammed users can not be retrivied from non-admin users.

Align the BP REST API with the web version, and show spammer users to Administrators only.

Props imath and emaralive.

See #9145
Fixes #9231

Location:

trunk

Files:

• src/bp-members/classes/class-bp-members-rest-controller.php (modified) (3 diffs)
• tests/phpunit/testcases/members/test-controller.php (modified) (8 diffs)

trunk/src/bp-members/classes/class-bp-members-rest-controller.php

@@ -244 +244 @@
                         $member       = reset( $member_query->results );
 
-                        $member   = $this->prepare_item_for_response( $member, $request );
-                        $response = rest_ensure_response( $member );
-
-                        return $response;
+                        $member = $this->prepare_item_for_response( $member, $request );
+
+                        return rest_ensure_response( $member );
                 }
 
@@ -258 +257 @@
          * @since 15.0.0
          *
-         * @param  WP_REST_Request $request Full details about the request.
+         * @param WP_REST_Request $request Full details about the request.
          * @return true|WP_Error
          */
@@ -281 +280 @@
                                         )
                                 );
-                        } elseif ( 'edit' === $request->get_param( 'context' ) ) {
-                                if ( get_current_user_id() === $user->ID || bp_current_user_can( 'list_users' ) ) {
-                                        $retval = true;
-                                } else {
-                                        $retval = new WP_Error(
-                                                'bp_rest_authorization_required',
-                                                __( 'Sorry, you are not allowed to view members with the edit context.', 'buddypress' ),
-                                                array(
-                                                        'status' => rest_authorization_required_code(),
-                                                )
-                                        );
-                                }
-                        } else {
+                        } elseif ( get_current_user_id() === $user->ID && ! bp_is_user_spammer( $user->ID ) ) {
+                                $retval = true;
+                        } elseif ( 'edit' === $request->get_param( 'context' ) && ! bp_current_user_can( 'list_users' ) ) {
+                                $retval = new WP_Error(
+                                        'bp_rest_authorization_required',
+                                        __( 'Sorry, you are not allowed to view members with the edit context.', 'buddypress' ),
+                                        array( 'status' => rest_authorization_required_code() )
+                                );
+                        } elseif ( bp_current_user_can( 'bp_moderate' ) || ! bp_is_user_spammer( $user->ID ) ) {
                                 $retval = true;
                         }

trunk/tests/phpunit/testcases/members/test-controller.php

@@ -37 +37 @@
                         )
                 );
-                $request->set_param( 'context', 'view' );
                 $response = $this->server->dispatch( $request );
 
@@ -65 +64 @@
                         )
                 );
-                $request->set_param( 'context', 'view' );
                 $response = $this->server->dispatch( $request );
 
@@ -115 +113 @@
 
                 $members = $response->get_data();
+
                 $this->assertNotEmpty( $members );
-
-                $this->assertTrue( 3 === count( $members ) );
+                $this->assertCount( 3, $members );
 
                 $latest_activities = wp_list_pluck( $members, 'last_activity', 'id' );
@@ -138 +136 @@
 
                 $request = new WP_REST_Request( 'GET', $this->endpoint_url );
+                $request->set_param( 'context', 'view' );
                 $request->set_query_params(
                         array(
@@ -146 +145 @@
                 );
 
-                $request->set_param( 'context', 'view' );
                 $response = $this->server->dispatch( $request );
 
@@ -183 +181 @@
 
                 $request = new WP_REST_Request( 'GET', $this->endpoint_url );
+                $request->set_param( 'context', 'view' );
                 $request->set_query_params(
                         array(
@@ -188 +187 @@
                         )
                 );
-                $request->set_param( 'context', 'view' );
                 $response = $this->server->dispatch( $request );
 
@@ -541 +539 @@
 
                 $this->assertErrorResponse( 'bp_rest_member_invalid_id', $response, 404 );
+        }
+
+        /**
+         * @group get_item
+         */
+        public function test_get_spammed_user() {
+                $u = static::factory()->user->create();
+
+                // Spam the user.
+                bp_core_process_spammer_status( $u, 'spam' );
+
+                $this->assertTrue( bp_is_user_spammer( $u ) );
+
+                $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+                $request->set_param( 'context', 'view' );
+                $response = $this->server->dispatch( $request );
+
+                $this->assertErrorResponse( 'bp_rest_authorization_required', $response, rest_authorization_required_code() );
+        }
+
+        /**
+         * @group get_item
+         */
+        public function test_get_spammed_user_with_random_logged_in_user() {
+                $u  = static::factory()->user->create();
+                $u2 = static::factory()->user->create();
+
+                // Spam the user.
+                bp_core_process_spammer_status( $u, 'spam' );
+
+                $this->assertTrue( bp_is_user_spammer( $u ) );
+
+                wp_set_current_user( $u2 );
+
+                $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+                $request->set_param( 'context', 'view' );
+                $response = $this->server->dispatch( $request );
+
+                $this->assertErrorResponse( 'bp_rest_authorization_required', $response, rest_authorization_required_code() );
+        }
+
+        /**
+         * @group get_item
+         */
+        public function test_get_spammed_user_with_spammed_user() {
+                $u = static::factory()->user->create();
+
+                // Spam the user.
+                bp_core_process_spammer_status( $u, 'spam' );
+
+                $this->assertTrue( bp_is_user_spammer( $u ) );
+
+                wp_set_current_user( $u );
+
+                $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+                $request->set_param( 'context', 'view' );
+                $response = $this->server->dispatch( $request );
+
+                $this->assertErrorResponse( 'bp_rest_authorization_required', $response, rest_authorization_required_code() );
+        }
+
+        /**
+         * @group get_item
+         */
+        public function test_get_spammed_user_as_admin() {
+                $u = static::factory()->user->create();
+
+                // Spam the user.
+                bp_core_process_spammer_status( $u, 'spam' );
+
+                $this->assertTrue( bp_is_user_spammer( $u ) );
+
+                wp_set_current_user( $this->user );
+
+                $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+                $request->set_param( 'context', 'view' );
+                $response = $this->server->dispatch( $request );
+
+                $this->assertEquals( 200, $response->get_status() );
+
+                $member = $response->get_data();
+
+                $this->assertNotEmpty( $member );
+                $this->assertSame( $u, $member['id'] );
         }