Commit Graph

608 Commits

Author SHA1 Message Date
Pascal Birchler a225165010 Role/Capability: Add support for capability queries in `WP_User_Query`.
Similar to the existing `role`/`role__in`/`role__not_in` query arguments, this adds support for three new query arguments in `WP_User_Query`:

* `capability` 
* `capability__in`
* `capability__not_in`

These can be used to fetch users with (or without) a specific set of capabilities, for example to get all users
with the capability to edit a certain post type.

Under the hood, this will check all existing roles on the site and perform a `LIKE` query against the `capabilities` user meta field to find:

* all users with a role that has this capability
* all users with the capability being assigned directly

Note: In WordPress, not all capabilities are stored in the database. Capabilities can also be modified using filters like `map_meta_cap`. These new query arguments do NOT work for such capabilities.

The prime use case for capability queries is to get all "authors", i.e. users with the capability to edit a certain post type.

Until now, `'who' => 'authors'` was used for this, which relies on user levels. However, user levels were deprecated a long time ago and thus never added to custom roles. This led to constant frustration due to users with custom roles missing from places like author dropdowns.

This updates any usage of `'who' => 'authors'` in core to use capability queries instead.

Subsequently, `'who' => 'authors'` queries are being **deprecated** in favor of these new query arguments.

Also adds a new `capabilities` parameter (mapping to `capability__in` in `WP_User_Query`) to the REST API users controller.

Also updates `twentyfourteen_list_authors()` in Twenty Fourteen to make use of this new functionality, adding a new `twentyfourteen_list_authors_query_args` filter to make it easier to override this behavior.

Props scribu, lgladdly, boonebgorges, spacedmonkey, peterwilsoncc, SergeyBiryukov, swissspidy.
Fixes #16841.

Built from https://develop.svn.wordpress.org/trunk@51943


git-svn-id: http://core.svn.wordpress.org/trunk@51532 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-10-27 18:43:57 +00:00
John Blackbourn 25da00ea81 Users: Introduce a `meta_input` argument for `wp_insert_user()`.
This allows custom user meta values to be provided when creating or updating a user in the same way custom post meta can be provided to `wp_insert_post()` when creating or updating a post.

Also introduces the `insert_custom_user_meta` to filter these values.

Props desrosj, donmhico

Fixes #41950

Built from https://develop.svn.wordpress.org/trunk@51738


git-svn-id: http://core.svn.wordpress.org/trunk@51346 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-09-07 21:31:55 +00:00
hellofromTonya c7d3e267b8 Coding Standards: Use static closures when not using `$this`.
When a closure does not use `$this`, it can be made `static` for improved performance.

Static closures are supported in PHP since PHP 5.4. ​

Props jrf, hellofromTonya, swissspidy, SergeyBiryukov.
See #53359.
Built from https://develop.svn.wordpress.org/trunk@51657


git-svn-id: http://core.svn.wordpress.org/trunk@51263 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-08-26 12:59:02 +00:00
desrosj f2b3c983f6 Docs: Various documentation fixes following [51129].
- Typo corrections in filter descriptions.
- DocBlocks are now now wrapped to the next line after 80 characters, and not extending beyond 120 total characters wide.
- Remove unnecessary repeated references to the suggested replacement hooks.
- Adjustments to the indentation for consistency with other emails in Core, allowing the `phpcs:ignore` comment to be removed.

Props SergeyBiryukov.
Fixes #44314.
Built from https://develop.svn.wordpress.org/trunk@51410


git-svn-id: http://core.svn.wordpress.org/trunk@51021 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-07-13 00:02:57 +00:00
Sergey Biryukov c205a7e583 Coding Standards: Rename the `$ID` variable to `$user_id` in `wp_insert_user()` and `wp_update_user()`.
This fixes a "Variable `$ID` is not in valid snake_case format" WPCS warning.

Follow-up to [2872].

See #53359.
Built from https://develop.svn.wordpress.org/trunk@51399


git-svn-id: http://core.svn.wordpress.org/trunk@51010 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-07-10 12:21:58 +00:00
Sergey Biryukov 514f23aef8 Users: Return earlier from `wp_update_user()` in case of error.
This ensures that if the `wp_insert_user()` call resulted in a `WP_Error` object, it is returned right away without any further actions.

Follow-up to [32820].

Fixes #53627.
Built from https://develop.svn.wordpress.org/trunk@51398


git-svn-id: http://core.svn.wordpress.org/trunk@51009 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-07-10 12:00:58 +00:00
John Blackbourn 5f67ba0406 Docs: Correct the `@since` tag for the `user_erasure_fulfillment_email_headers` filter.
See #44314, #53461

Built from https://develop.svn.wordpress.org/trunk@51353


git-svn-id: http://core.svn.wordpress.org/trunk@50962 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-07-06 18:18:02 +00:00
John Blackbourn ea60cd8191 Docs: Descriptive improvements and corrections for various docblocks.
See #53399

Built from https://develop.svn.wordpress.org/trunk@51300


git-svn-id: http://core.svn.wordpress.org/trunk@50909 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-07-01 21:12:58 +00:00
John Blackbourn 79685db062 Docs: Corrections and improvements to types used in docblocks for symbols, properties, and filters.
See #53399

Built from https://develop.svn.wordpress.org/trunk@51298


git-svn-id: http://core.svn.wordpress.org/trunk@50907 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-07-01 21:02:57 +00:00
antpb 06cddbd3b3 Privacy: Improve naming of user confimed action email filters.
The filters `user_confirmed_action_email_content`, `user_erasure_complete_email_subject`, and `user_erasure_complete_email_headers` have been deprecated.

They have been replaced with `user_erasure_fulfillment_email_content`, `user_erasure_fulfillment_email_subject`, and `user_erasure_fulfillment_email_headers`.

Props desrosj, garrett-eclipse, birgire, DrewAPicture, lifeforceinst, ocean90, pbiron, pento, coffee2code, TZ-Media, SergeyBiryukov, johnbillion, audrasjb, davidbaumwald, hellofromTonya, helen, xkon, antpb, peterwilsoncc, lukecarbis.
Fixes #44314.


Built from https://develop.svn.wordpress.org/trunk@51129


git-svn-id: http://core.svn.wordpress.org/trunk@50738 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-06-09 01:35:58 +00:00
desrosj 37652569e4 Login and Registration: Improve the unknown username error message
The new message is more clear and makes the next step more clear to the user. 

Props dd32, SergeyBiryukov, audrasjb, desrosj, dlh, marybaum, chanthaboune, jeffpaul.
Fixes #52915.
Built from https://develop.svn.wordpress.org/trunk@51126


git-svn-id: http://core.svn.wordpress.org/trunk@50735 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-06-08 23:34:58 +00:00
Dominik Schilling ce4da03303 Users: Add user’s locale to password reset link to ensure login screen matches the language of the email.
Props walbo.
See #34281, #52605.
Fixes #53321.
Built from https://develop.svn.wordpress.org/trunk@51077


git-svn-id: http://core.svn.wordpress.org/trunk@50686 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-06-06 12:41:01 +00:00
desrosj a07a6490ab Users: Pass on the user data received by `wp_insert_user()` to related hooks.
This adds a new parameter to the action and filter hooks found in `wp_insert_user()` to pass the raw user data received through `$userdata` to hooked functions.

This will allow hooked functions to perform more contextual adjustments to new users, and makes supplying custom user meta fields possible.

Props johnbillion, audrasjb.
Fixes #53110.
Built from https://develop.svn.wordpress.org/trunk@51005


git-svn-id: http://core.svn.wordpress.org/trunk@50614 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-05-25 17:39:57 +00:00
desrosj 0d1e4e553c General: Avoid unnecessary calls to `update_user_option()`.
The `update_user_option()` function is a way to update a user meta value after adding a blog’s prefix to the beginning of the meta key. But when the fourth parameter is `true`, the behavior is exactly the same as calling `update_user_meta()` directly.

This replaces all instances of `update_user_option()` when the fourth parameter is `true` in Core with a direct call to `update_user_meta()` to prevent an unnecessary call to `update_user_option()`.

Props johnjamesjacoby, zkancs, obenland, desrosj.
Fixes #43339.
Built from https://develop.svn.wordpress.org/trunk@50981


git-svn-id: http://core.svn.wordpress.org/trunk@50590 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-05-24 19:59:57 +00:00
Sergey Biryukov 893beee31e General: Ensure consistent type for integer properties of `WP_Post`, `WP_Term`, and `WP_User`.
Previously, these properties could be unexpectedly converted to strings in some contexts.

This applies to the following functions:

* `sanitize_post_field()`
* `sanitize_term_field()`
* `sanitize_user_field()`

and the following properties:

* `WP_Post::ID`
* `WP_Post::post_parent`
* `WP_Post::menu_order`
* `WP_Term::term_id`
* `WP_Term::term_taxonomy_id`
* `WP_Term::parent`
* `WP_Term::count`
* `WP_Term::term_group`
* `WP_User::ID`

Props grantmkin, SergeyBiryukov.
Fixes #53235. See #52995.
Built from https://develop.svn.wordpress.org/trunk@50935


git-svn-id: http://core.svn.wordpress.org/trunk@50544 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-05-19 22:11:56 +00:00
Sergey Biryukov 63ea8284a3 Docs: Miscellaneous DocBlock corrections.
See #52628.
Built from https://develop.svn.wordpress.org/trunk@50916


git-svn-id: http://core.svn.wordpress.org/trunk@50525 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-05-15 17:38:05 +00:00
Peter Wilson de519f9dfe Users: Share current user instance across functions.
Share the `WP_User` instance for the current user between the functions `get_userdata()` and `wp_get_current_user()`. Both functions return the `$current_user` global for the current user.

Force refresh the `$current_user` global within `clean_user_cache()` by immediately re-calling `wp_set_current_user()` with the current user's ID. This ensures any changes to the current user's permissions or other settings are reflected in the global. As a side-effect this immediately rewarms the current user's cache.

Props chaion07, chriscct7, donmhico, hellofromtonya, lukecarbis, peterwilsoncc, rmccue, TimothyBlynJacobs.
Fixes #28020.

Built from https://develop.svn.wordpress.org/trunk@50790


git-svn-id: http://core.svn.wordpress.org/trunk@50399 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-04-26 01:03:59 +00:00
davidbaumwald 133c4e2e50 Docs: Clarify return results for a non-existing ID in metadata functions.
[48658] documented that various metadata functions return false for an invalid ID. However, that does not clarify what an invalid ID is: a non-numeric, zero, or negative value. This change adds the clarification in all relevant metadata function docblocks.

Props icopydoc, SergeyBiryukov, davidkryzaniak, audrasjb.
Fixes #51797.
Built from https://develop.svn.wordpress.org/trunk@50641


git-svn-id: http://core.svn.wordpress.org/trunk@50253 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-04-02 15:49:05 +00:00
Sergey Biryukov 2c6e1dc1f9 Login and Registration: Restore the "Error:" prefix for the "Unknown username" message.
This makes the message more consistent with other error messages related to authentication and registration.

Follow-up to [46417].

Props dd32.
See #52914, #52915.
Built from https://develop.svn.wordpress.org/trunk@50589


git-svn-id: http://core.svn.wordpress.org/trunk@50202 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-03-26 12:14:07 +00:00
Peter Wilson 7b26eac3a3 Users: Use localized site title for password reset emails.
When sending password reset emails, switch to the user's locale prior to obtaining the site title to allow for plugins filtering based on locale.

Follow up to [50129,50139-50141,50152,50415].

Props chouby.
Fixes #52605. See #34281.


Built from https://develop.svn.wordpress.org/trunk@50439


git-svn-id: http://core.svn.wordpress.org/trunk@50050 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-26 00:52:02 +00:00
Sergey Biryukov 9a4cbd05e8 Users: Only include the IP address in password reset email if the user is not logged in.
This avoids unnecessarily disclosing the IP address when sending a password reset link to another user from the admin.

Follow-up to [49255], [50129].

Props carike, audrasjb, gmariani405, Ipstenu.
See #34281.
Built from https://develop.svn.wordpress.org/trunk@50422


git-svn-id: http://core.svn.wordpress.org/trunk@50033 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-23 20:08:03 +00:00
desrosj 89f2e512f5 Users: Ensure reset password emails are in the receiving user’s locale.
This ensures that reset password emails initiated by an administrator are sent to the user in their preferred locale.

Follow up to [50129,50139-50141,50152].

Props chouby, davidbaumwald, audrasjb, johnbillion.
Fixes #52605. See #34281.
Built from https://develop.svn.wordpress.org/trunk@50415


git-svn-id: http://core.svn.wordpress.org/trunk@50026 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-23 16:38:06 +00:00
Sergey Biryukov a80f705d97 Privacy: Rename the `$send_confirmation_email` parameter of `wp_create_user_request()` to `$status`, for clarity.
Follow-up to [50159], [50165].

Props xkon, TimothyBlynJacobs.
Fixes #52430. See #43890.
Built from https://develop.svn.wordpress.org/trunk@50230


git-svn-id: http://core.svn.wordpress.org/trunk@49891 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-05 15:50:05 +00:00
Sergey Biryukov 8984e4ef8c Docs: Update documentation for `wp_create_user_request()` per the documentation standards.
Add a `@since` note for the `$send_confirmation_email` parameter.

Follow-up to [50159].

See #43890.
Built from https://develop.svn.wordpress.org/trunk@50165


git-svn-id: http://core.svn.wordpress.org/trunk@49844 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-02 20:42:03 +00:00
antpb 64bb29d087 Privacy: Allow Admin to Skip e-mail confirmation for Export.
This adds a form option to skip the admin email alert when exporting personal data.

Props xkon, azaozz, TZ-Media, iandunn, desrosj, iprg, allendav, wesselvandenberg, karmatosed, birgire, davidbaumwald, estelaris, paaljoachim, hellofromTonya.
Fixes #43890.

Built from https://develop.svn.wordpress.org/trunk@50159


git-svn-id: http://core.svn.wordpress.org/trunk@49838 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-02 19:45:03 +00:00
Sergey Biryukov c5482c9b82 Docs: Update documentation for `retrieve_password()` per the documentation standards.
Follow-up to [50129], [50140].

See #34281.
Built from https://develop.svn.wordpress.org/trunk@50141


git-svn-id: http://core.svn.wordpress.org/trunk@49820 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-02 12:43:04 +00:00
Sergey Biryukov 22188b3e85 Users: Move `retrieve_password()` to `wp-includes/user.php`, for consistency with other user functions.
Follow-up to [25231], [50129].

Props jfarthing84, dimadin.
See #34281, #31039.
Built from https://develop.svn.wordpress.org/trunk@50140


git-svn-id: http://core.svn.wordpress.org/trunk@49819 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-02-02 12:37:03 +00:00
Sergey Biryukov 4104f92d7f Privacy: Use more consistent wording for strings related to personal data requests.
This replaces "user privacy" in various error messages with "personal data", for consistency with other existing strings.

Follow-up to [49090].

Props xkon, transl8or.
Fixes #51849.
Built from https://develop.svn.wordpress.org/trunk@49970


git-svn-id: http://core.svn.wordpress.org/trunk@49671 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-01-17 17:46:06 +00:00
Sergey Biryukov 7ced0efbf4 Docs: Use more consistent descriptions for `void|false` return values.
See #51800.
Built from https://develop.svn.wordpress.org/trunk@49935


git-svn-id: http://core.svn.wordpress.org/trunk@49634 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-01-05 16:48:07 +00:00
Sergey Biryukov 37662df05e Docs: In various `@return` tags, list the expected type first, instead of `false` or `WP_Error`.
Follow-up to [46696], [47060], [49926], [49927].

See #51800.
Built from https://develop.svn.wordpress.org/trunk@49929


git-svn-id: http://core.svn.wordpress.org/trunk@49628 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-01-04 17:18:04 +00:00
John Blackbourn dfe1f9b322 Docs: Promote many `bool` types to `true` or `false` where only that value is used.
See #51800

Built from https://develop.svn.wordpress.org/trunk@49927


git-svn-id: http://core.svn.wordpress.org/trunk@49626 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-01-03 22:04:04 +00:00
John Blackbourn 53da9208dd Docs: Various docblock corrections particularly relating to boolean types.
See #51800

Built from https://develop.svn.wordpress.org/trunk@49926


git-svn-id: http://core.svn.wordpress.org/trunk@49625 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-01-03 21:57:09 +00:00
TimothyBlynJacobs fa88bbfc79 App Passwords: Only attempt auth if the username and password are set.
Previously, only the username was checked which caused a PHP warning in some server setups, for instance Shibboleth SSO, where the server only populates the `PHP_AUTH_USER` field.

Props MadtownLems, johnbillion, richard.tape, engahmeds3ed.
Fixes #52003.

Built from https://develop.svn.wordpress.org/trunk@49919


git-svn-id: http://core.svn.wordpress.org/trunk@49618 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2021-01-02 21:35:04 +00:00
John Blackbourn 42fcfa5b3d Docs: Various docblock corrections.
See #51800

Built from https://develop.svn.wordpress.org/trunk@49789


git-svn-id: http://core.svn.wordpress.org/trunk@49512 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-12-10 23:53:07 +00:00
TimothyBlynJacobs aac98aae97 App Passwords: Prevent conflicts when Basic Auth is already used by the site.
Application Passwords uses Basic Authentication to transfer authentication details. If the site is already using Basic Auth, for instance to implement a private staging environment, then the REST API will treat this as an authentication attempt and would end up generating an error for any REST API request.

Now, Application Password authentication will only be attempted if Application Passwords is in use by a site. This is flagged by setting an option whenever an Application Password is created. An upgrade routine is added to set this option if any App Passwords already exist.

Lastly, creating an Application Password will be prevented if the site appears to already be using Basic Authentication.

Props chexwarrior, georgestephanis, adamsilverstein, helen, Clorith, marybaum, TimothyBlynJacobs.
Fixes #51939.


Built from https://develop.svn.wordpress.org/trunk@49752


git-svn-id: http://core.svn.wordpress.org/trunk@49475 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-12-04 21:44:07 +00:00
John Blackbourn f4cda1b62f Docs: Upgrade more parameters in docblocks to used typed array notation.
See #51800, #41756

Built from https://develop.svn.wordpress.org/trunk@49693


git-svn-id: http://core.svn.wordpress.org/trunk@49416 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-11-24 21:27:05 +00:00
John Blackbourn 35f6c356c1 Docs: Document parameters that accept an array of integers using typed array notation.
While many of these parameters also technically accept an array of numerical strings, they are all ultimately cast to an array of integers. Documenting them as such assists developers in understanding the expected types.

See #51800, #41756

Built from https://develop.svn.wordpress.org/trunk@49672


git-svn-id: http://core.svn.wordpress.org/trunk@49395 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-11-19 18:24:09 +00:00
Sergey Biryukov f7d3a8b5c4 App Passwords: Add missing i18n for an error message.
Follow-up to [49617].

See #51513.
Built from https://develop.svn.wordpress.org/trunk@49627


git-svn-id: http://core.svn.wordpress.org/trunk@49365 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-11-17 10:21:08 +00:00
TimothyBlynJacobs d9b35c8e98 App Passwords: Unify availability language.
Previously App Passwords used a mix of "enabled" and "available". We've now standardized on using "available".

Additionally, we now use a 501 status code when indicating that App Passwords is not available.

Props SergeyBiryukov, ocean90, TimothyBlynJacobs.
Fixes #51513.

Built from https://develop.svn.wordpress.org/trunk@49617


git-svn-id: http://core.svn.wordpress.org/trunk@49355 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-11-16 22:42:04 +00:00
Helen Hou-Sandí 340c834fa3 Privacy: More precise checking of user request action names.
Props garrett-eclipse.
Fixes #46536.

Built from https://develop.svn.wordpress.org/trunk@49475


git-svn-id: http://core.svn.wordpress.org/trunk@49234 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-11-02 18:42:04 +00:00
Sergey Biryukov 1ce2f12eaf Docs: Correct description for `wp_pre_insert_user_data` filter.
Props audrasjb.
Fixes #51637.
Built from https://develop.svn.wordpress.org/trunk@49314


git-svn-id: http://core.svn.wordpress.org/trunk@49076 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-26 22:53:06 +00:00
John Blackbourn 727922c8eb Docs: Further corrections and promotions for docblocks relating to `object` types.
See #50768

Built from https://develop.svn.wordpress.org/trunk@49197


git-svn-id: http://core.svn.wordpress.org/trunk@48959 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-18 20:53:08 +00:00
John Blackbourn c16ae60deb Docs: Fix and upgrade various `object` docblock notations.
See #50768

Built from https://develop.svn.wordpress.org/trunk@49183


git-svn-id: http://core.svn.wordpress.org/trunk@48945 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-17 16:05:09 +00:00
Sergey Biryukov 22c86907c4 Docs: Improve description of the `$email` parameter in `email_exists()`.
Follow-up to [49148].

Props garrett-eclipse.
See #51379.
Built from https://develop.svn.wordpress.org/trunk@49153


git-svn-id: http://core.svn.wordpress.org/trunk@48915 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-15 00:16:08 +00:00
Sergey Biryukov 118b9aea4d Users: Introduce `email_exists` filter, to complement `username_exists`.
Props garrett-eclipse, apermo, mukesh27, Mista-Flo, sebastian.pisula, mikelopez.
Fixes #51379. See #35509.
Built from https://develop.svn.wordpress.org/trunk@49148


git-svn-id: http://core.svn.wordpress.org/trunk@48910 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-14 19:04:08 +00:00
Dominik Schilling 4dfe5ecfe1 Users: Enable Application Passwords for local development environments, even if HTTPS is not available.
This will make testing the new feature easier since the local development environment is only accessible via HTTP by default.
Also update docs to link to the relevant filters.

See #42790.
Fixes #51503.
Built from https://develop.svn.wordpress.org/trunk@49139


git-svn-id: http://core.svn.wordpress.org/trunk@48901 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-13 20:10:04 +00:00
TimothyBlynJacobs d5ebe12f11 REST API: Introduce Application Passwords for API authentication.
In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.

This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.

Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.

Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes #42790.

Built from https://develop.svn.wordpress.org/trunk@49109


git-svn-id: http://core.svn.wordpress.org/trunk@48871 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-08 22:14:06 +00:00
Sergey Biryukov 1651342d2b Privacy: Improve clarity of privacy error strings.
Primarily this adds "user privacy" to the strings for privacy requests, so they are more easily distinguished from other system actions within logs.

Props garrett-eclipse, carike, birgire.
Fixes #51351.
Built from https://develop.svn.wordpress.org/trunk@49090


git-svn-id: http://core.svn.wordpress.org/trunk@48852 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-10-04 03:23:09 +00:00
Sergey Biryukov d4a319c453 Users: Check if the user ID passed as `selected` to `wp_dropdown_users()` corresponds to an existing user.
This avoids a few PHP notices if the `include_selected` parameter was specified and a non-existing user ID was passed.

Props campusboy1987.
Fixes #51370.
Built from https://develop.svn.wordpress.org/trunk@49036


git-svn-id: http://core.svn.wordpress.org/trunk@48798 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-09-23 00:27:07 +00:00
John Blackbourn aef504acfd Docs: Correct the indentation for some array type docs.
See #50768

Built from https://develop.svn.wordpress.org/trunk@49028


git-svn-id: http://core.svn.wordpress.org/trunk@48790 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2020-09-21 16:46:06 +00:00