#46744 Prevent the default role from being set to a privileged role when user registration is open

src/wp-admin/options-general.php

@@ -305,15 +305,20 @@ class="<?php echo esc_attr( $classes_for_button ); ?>"
 <th scope="row"><label for="default_role"><?php _e( 'New User Default Role' ); ?></label></th>
 <td>
 	<?php
+	/** This filter is documented in wp-includes/functions.php */
+	$roles_to_exclude = apply_filters( 'default_role_excluded_roles', array( 'administrator', 'editor' ) );
+
 	/**
 	 * Filters the roles to be excluded from the default_role option.
 	 *
+	 * See also the {@see 'default_role_excluded_roles'} filter.
+	 *
 	 * @since 7.0.0
 	 *
 	 * @param string[] $roles_to_exclude Array of roles to exclude from the dropdown.
 	 *                                   Defaults to administrator and editor.
 	 */
-	$excluded_roles = (array) apply_filters( 'default_role_dropdown_excluded_roles', array( 'administrator', 'editor' ) );
+	$excluded_roles = (array) apply_filters( 'default_role_dropdown_excluded_roles', $roles_to_exclude );
 
 	$editable_roles = array_reverse( get_editable_roles() );
 

src/wp-includes/default-filters.php

@@ -302,6 +302,7 @@
 add_filter( 'option_blog_charset', '_canonical_charset' );
 add_filter( 'option_home', '_config_wp_home' );
 add_filter( 'option_siteurl', '_config_wp_siteurl' );
+add_filter( 'option_default_role', 'filter_default_role' );
 add_filter( 'tiny_mce_before_init', '_mce_set_direction' );
 add_filter( 'teeny_mce_before_init', '_mce_set_direction' );
 add_filter( 'pre_kses', 'wp_pre_kses_less_than' );

src/wp-includes/functions.php

@@ -9415,3 +9415,43 @@ function wp_verify_fast_hash(
 
 	return hash_equals( $hash, wp_fast_hash( $message ) );
 }
+
+/**
+ * Filters the default role for new user registrations.
+ *
+ * This ensures that privileged roles are not made available as the default role when user registration is enabled.
+ *
+ * @since 7.2.0
+ *
+ * @param string $default_role The default role for new user registrations.
+ * @return string The filtered default role for new user registrations.
+ */
+function filter_default_role( $default_role ) {
+	static $filtering = false;
+
+	if ( $filtering ) {
+		return $default_role;
+	}
+
+	$filtering = true;
+
+	if ( get_option( 'users_can_register' ) ) {
+		/**
+		 * Filters the roles that are excluded from being available as the default role for new user registrations.
+		 *
+		 * @since 7.2.0
+		 *
+		 * @param string[] $roles Roles that are excluded from being available.
+		 */
+		$excluded = apply_filters( 'default_role_excluded_roles', array( 'administrator', 'editor' ) );
+
+		// Don't allow a privileged default role if users can register.
+		if ( in_array( $default_role, $excluded, true ) ) {
+			$default_role = 'subscriber';
+		}
+	}
+
+	$filtering = false;
+
+	return $default_role;
+}

tests/phpunit/tests/functions/filterDefaultRole.php

@@ -0,0 +1,213 @@
+<?php
+
+/**
+ * Tests for the filtering of the `default_role` option.
+ *
+ * @group option
+ * @group user
+ *
+ * @covers ::filter_default_role
+ */
+class Tests_Functions_FilterDefaultRole extends WP_UnitTestCase {
+
+	/**
+	 * Opens or closes user registration.
+	 */
+	private function set_users_can_register( bool $can_register ) {
+		if ( is_multisite() ) {
+			update_site_option( 'registration', $can_register ? 'user' : 'none' );
+		} else {
+			update_option( 'users_can_register', $can_register ? 1 : 0 );
+		}
+	}
+
+	/**
+	 * Ensures privileged roles are left alone when user registration is closed.
+	 *
+	 * @dataProvider data_excluded_roles
+	 */
+	public function test_excluded_role_is_unchanged_when_registration_is_closed( string $role ) {
+		$this->set_users_can_register( false );
+
+		$this->assertSame(
+			$role,
+			filter_default_role( $role ),
+			'The default role was changed while user registration was closed.'
+		);
+	}
+
+	/**
+	 * Ensures privileged roles are replaced with the subscriber role when user registration is open.
+	 *
+	 * @dataProvider data_excluded_roles
+	 */
+	public function test_excluded_role_is_replaced_when_registration_is_open( string $role ) {
+		$this->set_users_can_register( true );
+
+		$this->assertSame(
+			'subscriber',
+			filter_default_role( $role ),
+			'The privileged default role was not replaced with the subscriber role.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_excluded_roles() {
+		return array(
+			'administrator' => array( 'administrator' ),
+			'editor'        => array( 'editor' ),
+		);
+	}
+
+	/**
+	 * Ensures roles that are not excluded are left alone when user registration is open.
+	 *
+	 * @dataProvider data_allowed_roles
+	 */
+	public function test_allowed_role_is_unchanged_when_registration_is_open( string $role ) {
+		$this->set_users_can_register( true );
+
+		$this->assertSame(
+			$role,
+			filter_default_role( $role ),
+			'A role which is not excluded was changed.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_allowed_roles() {
+		return array(
+			'author'       => array( 'author' ),
+			'contributor'  => array( 'contributor' ),
+			'subscriber'   => array( 'subscriber' ),
+			'unknown role' => array( 'this-role-does-not-exist' ),
+			'empty string' => array( '' ),
+		);
+	}
+
+	/**
+	 * Ensures a role can be added to the list of excluded roles.
+	 */
+	public function test_excluded_roles_can_be_added_to() {
+		$this->set_users_can_register( true );
+
+		add_filter(
+			'default_role_excluded_roles',
+			static function ( $excluded ) {
+				$excluded[] = 'author';
+				return $excluded;
+			}
+		);
+
+		$this->assertSame(
+			'subscriber',
+			filter_default_role( 'author' ),
+			'A role added to the excluded roles was not replaced with the subscriber role.'
+		);
+	}
+
+	/**
+	 * Ensures a role can be removed from the list of excluded roles.
+	 */
+	public function test_excluded_roles_can_be_removed() {
+		$this->set_users_can_register( true );
+
+		add_filter( 'default_role_excluded_roles', '__return_empty_array' );
+
+		$this->assertSame(
+			'administrator',
+			filter_default_role( 'administrator' ),
+			'A role removed from the excluded roles was replaced.'
+		);
+	}
+
+	/**
+	 * Ensures a new user is not assigned a privileged role when user registration is open.
+	 */
+	public function test_new_user_is_not_assigned_a_privileged_role() {
+		$this->set_users_can_register( true );
+		update_option( 'default_role', 'administrator' );
+
+		$user_id = wp_insert_user(
+			array(
+				'user_login' => 'test_default_role',
+				'user_pass'  => 'password',
+				'user_email' => 'test_default_role@example.org',
+			)
+		);
+
+		$this->assertNotWPError( $user_id, 'The user was not created.' );
+		$this->assertSame(
+			array( 'subscriber' ),
+			get_userdata( $user_id )->roles,
+			'The new user was assigned a privileged role.'
+		);
+	}
+
+	/**
+	 * Ensures the network registration setting governs the default role on Multisite, even when
+	 * the `users_can_register` option of the current site is closed.
+	 *
+	 * @ticket 46744
+	 * @group ms-required
+	 */
+	public function test_network_registration_governs_when_site_option_is_closed() {
+		update_site_option( 'registration', 'user' );
+		update_option( 'users_can_register', 0 );
+
+		$this->assertSame(
+			'subscriber',
+			filter_default_role( 'administrator' ),
+			'The privileged default role was not replaced while network registration was open.'
+		);
+	}
+
+	/**
+	 * Ensures the network registration setting governs the default role on Multisite, even when
+	 * the `users_can_register` option of the current site is open.
+	 *
+	 * @ticket 46744
+	 * @group ms-required
+	 */
+	public function test_network_registration_governs_when_site_option_is_open() {
+		update_site_option( 'registration', 'none' );
+		update_option( 'users_can_register', 1 );
+
+		$this->assertSame(
+			'administrator',
+			filter_default_role( 'administrator' ),
+			'The default role was changed while network registration was closed.'
+		);
+	}
+
+	/**
+	 * Ensures a new user is assigned the stored role when user registration is closed.
+	 */
+	public function test_new_user_is_assigned_the_stored_role_when_registration_is_closed() {
+		$this->set_users_can_register( false );
+		update_option( 'default_role', 'editor' );
+
+		$user_id = wp_insert_user(
+			array(
+				'user_login' => 'test_default_role',
+				'user_pass'  => 'password',
+				'user_email' => 'test_default_role@example.org',
+			)
+		);
+
+		$this->assertNotWPError( $user_id, 'The user was not created.' );
+		$this->assertSame(
+			array( 'editor' ),
+			get_userdata( $user_id )->roles,
+			'The new user was not assigned the stored default role.'
+		);
+	}
+}