Skip to content

Role/Capability: Add is_user_member_of_blog filter#11597

Open
dd32 wants to merge 1 commit intoWordPress:trunkfrom
dd32:65096-is-user-member-of-blog-filter
Open

Role/Capability: Add is_user_member_of_blog filter#11597
dd32 wants to merge 1 commit intoWordPress:trunkfrom
dd32:65096-is-user-member-of-blog-filter

Conversation

@dd32
Copy link
Copy Markdown
Member

@dd32 dd32 commented Apr 18, 2026

Trac ticket: https://core.trac.wordpress.org/ticket/65096

Summary

  • Adds an is_user_member_of_blog filter so plugins can dynamically grant or revoke a user's membership of a blog without having to spoof {$prefix}capabilities user meta (as WordPress.org currently does for its REST API user endpoints).
  • The filter receives the computed membership, the resolved user ID, and the resolved blog ID, and only runs once the function has confirmed a valid user on a valid (non-archived/spam/deleted) multisite site — short-circuited paths (logged out, unknown user, invalid site) continue to return without invoking the filter, so the filter isn't load-bearing for "empty" inputs.
  • @since is 7.1.0, matching src/wp-includes/version.php on trunk.

Test plan

  • phpunit --group ms-required tests/phpunit/tests/user/multisite.php — includes two new cases: one that forces the return value to true for a non-member and asserts the filter's arguments, and one that asserts the filter is not called for the short-circuited paths.
  • Manually register a filter on a multisite install and confirm the REST users controller now respects the filtered membership.

Disclosure: this PR (code, tests, and description) was generated by Claude Code on behalf of @dd32 and pushed before he had a chance to review. Treat it as an unreviewed AI draft — please scrutinise accordingly.

Allows plugins to dynamically grant or revoke a user's membership of a blog
without having to spoof `{$prefix}capabilities` user meta. The filter only
runs when both the user and blog have resolved to valid records on a
multisite install, so short-circuited calls (logged-out requests, unknown
users, archived/spammed/deleted sites) continue to return without invoking
the filter.

Props dd32.
Fixes #65096.
@github-actions
Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @user@claude.home.dd32.au.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Comment thread src/wp-includes/user.php
* @since 7.1.0
*
* @param bool $is_member Whether the user is a member of the blog.
* @param int $user_id The user ID being checked.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we needs to add Defaults to the current user. for better doc for param?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants