From 09930e001410a66f3e38c55d930081dbb11121aa Mon Sep 17 00:00:00 2001
From: Igor Rozum <rozumiq@gmail.com>
Date: Tue, 28 Jul 2026 20:12:00 -0400
Subject: [PATCH 1/2] Script Loader: Add tests for compression_test()
 capability check

---
 .../phpunit/tests/admin/includesTemplate.php  | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tests/phpunit/tests/admin/includesTemplate.php b/tests/phpunit/tests/admin/includesTemplate.php
index 4b9b8bc68034e..093bfbf8d2015 100644
--- a/tests/phpunit/tests/admin/includesTemplate.php
+++ b/tests/phpunit/tests/admin/includesTemplate.php
@@ -547,4 +547,41 @@ public function data_get_submit_button_shorthand() {
 			'raw button-compact unchanged' => array( 'button-compact', 'button button-compact' ),
 		);
 	}
+
+	/**
+	 * Tests that compression_test() has no effect for users who cannot
+	 * manage_options, matching its own documented behavior.
+	 *
+	 * @ticket 65750
+	 *
+	 * @covers ::compression_test
+	 */
+	public function test_compression_test_outputs_nothing_for_user_without_manage_options() {
+		wp_set_current_user( self::$editor_id );
+
+		ob_start();
+		compression_test();
+		$output = ob_get_clean();
+
+		$this->assertSame( '', $output );
+	}
+
+	/**
+	 * Tests that compression_test() still outputs the test script for
+	 * users who can manage_options.
+	 *
+	 * @ticket 65750
+	 *
+	 * @covers ::compression_test
+	 */
+	public function test_compression_test_outputs_script_for_user_with_manage_options() {
+		$admin_id = self::factory()->user->create( array( 'role' => 'administrator' ) );
+		wp_set_current_user( $admin_id );
+
+		ob_start();
+		compression_test();
+		$output = ob_get_clean();
+
+		$this->assertStringContainsString( 'testCompression', $output );
+	}
 }

From 73c5909b6a9836e8d547575febd176b83082ee3f Mon Sep 17 00:00:00 2001
From: Igor Rozum <rozumiq@gmail.com>
Date: Tue, 28 Jul 2026 20:12:06 -0400
Subject: [PATCH 2/2] Script Loader: Guard compression_test() output with
 manage_options check

---
 src/wp-admin/includes/template.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/wp-admin/includes/template.php b/src/wp-admin/includes/template.php
index bafd5f0904769..080db718f9081 100644
--- a/src/wp-admin/includes/template.php
+++ b/src/wp-admin/includes/template.php
@@ -2495,6 +2495,9 @@ function get_media_states( $post ) {
  * @since 2.8.0
  */
 function compression_test() {
+	if ( ! current_user_can( 'manage_options' ) ) {
+		return;
+	}
 	?>
 	<script>
 	var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;