Skip to content

Show the MFA notice only for users with manage_options capabilities #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andrea-sdl merged 3 commits into from
Jun 9, 2025
Merged

Show the MFA notice only for users with manage_options capabilities #27

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
818621b
show the notice to admins only
andrea-sdl Jun 6, 2025
dbb3318
remove duplicated code
andrea-sdl Jun 6, 2025
24aa150
improve comment
andrea-sdl Jun 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions modules/highlight-mfa-users/class-highlight-mfa-users.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,11 @@ public static function display_mfa_disabled_notice() {
return;
}

// Only show the notice to admins
if ( ! current_user_can( 'manage_options' ) ) {
return;
}

// Only show on the main users list table
$screen = get_current_screen();
if ( ! $screen || 'users' !== $screen->id ) {
Expand Down
23 changes: 21 additions & 2 deletions tests/phpunit/test-highlight-mfa-users.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ public function setUp(): void {

// Set skipped users option
update_option( Highlight_MFA_Users::MFA_SKIP_USER_IDS_OPTION_KEY, [ $this->admin_user_mfa_skipped_id ] );

wp_set_current_user( $this->admin_user_mfa_enabled_id );
Highlight_MFA_Users::init();
}

Expand All @@ -85,7 +85,7 @@ public function tearDown(): void {
$_GET = $this->original_get;
$GLOBALS['current_screen'] = $this->original_current_screen;
unset( $GLOBALS['current_screen'] ); // Ensure it's fully removed if it wasn't set before

wp_set_current_user( 0 );
parent::tearDown();
}

Expand Down Expand Up @@ -195,6 +195,25 @@ public function test_filter_users_by_mfa_status_does_nothing_on_wrong_page() {
unset( $_GET['filter_mfa_disabled'] );
}


/**
* Test that the admin notice is displayed correctly when MFA-disabled admins exist.
Copy link
Copy Markdown
Contributor

@brunobasto brunobasto Jun 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: I think you meant "when the user is not an admin" since we're testing with the editor role here.

*/
public function test_display_mfa_disabled_notice_does_not_show_when_not_admin() {
$this->set_admin_screen_users();
// Set a non-admin user
wp_set_current_user( $this->editor_user_id );

ob_start();
Highlight_MFA_Users::display_mfa_disabled_notice();
$output = ob_get_clean();

$this->assertEquals( '', $output );

// Reset current user
wp_set_current_user( 0 );
}

/**
* Test that the admin notice is displayed correctly when MFA-disabled admins exist.
*/
Expand Down