Repository navigation
Block and widget role restrictions: use payment-aware roles - #55
Merged
Merged
Conversation
Core's wpum_get_user_access_roles() lets integrations withhold roles, e.g. Stripe while a payment is outstanding. The block and legacy widget role checks read $user->roles directly, so an account that hadn't paid still saw content restricted to its role. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
php-scoper prefixes the name inside function_exists(), so in core's vendor-dist the guard was always false and the raw roles were used. This file already calls core functions unguarded, and core pins the wpum-blocks version, so the guard isn't needed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The "Show block by user role" restriction, and the same setting on legacy widgets, compared the allowed roles with
$current_user->roles. Core's shortcode and Elementor restrictions usewpum_get_user_access_roles()instead, which integrations filter (wpum_user_access_roles). The Stripe integration returns no roles there while an account still owes a payment, so a user who registered on a paid form and never paid could see blocks and widgets restricted to their role, while the shortcode next to them stayed hidden.Changes
maybe_restrict_content()andmaybe_restrict_widget()usewpum_get_user_access_roles( $current_user ). Nofunction_exists()guard: php-scoper prefixes the name inside it, so in core'svendor-distit was always false. The file already calls core functions unguarded, and core pins this package's version.Tests
wpum-blocks has no suite. The tests are in core's
tests/wpunit/Stripe/UnpaidCapabilitiesTest.php, which runs against this package once core requires the new tag.Reported by elba.code via Patchstack.
🤖 Generated with Claude Code