From 7ecdb293b4253b615df6eaf487d0744b319c8777 Mon Sep 17 00:00:00 2001
From: Jonny Harris <jon@spacedmonkey.co.uk>
Date: Fri, 2 Oct 2026 10:34:02 +0100
Subject: [PATCH] Enhance REST API: Default site retrieval to current network
 if no network filter is provided

---
 .../class-wp-rest-sites-controller.php        |  5 +++
 .../tests/rest-api/wpRestSitesController.php  | 44 +++++++++++++++++++
 2 files changed, 49 insertions(+)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-sites-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-sites-controller.php
index 49a28912cb3a0..6e2b1b94c3b95 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-sites-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-sites-controller.php
@@ -230,6 +230,11 @@ public function get_items( $request ) {
 			}
 		}
 
+		// Without an explicit network filter, limit the results to the current network.
+		if ( empty( $prepared_args['network__in'] ) ) {
+			$prepared_args['network__in'] = array( get_current_network_id() );
+		}
+
 		// WP_Site_Query tests the status columns with is_numeric(), and a boolean is not numeric.
 		foreach ( array( 'public', 'archived', 'mature', 'spam', 'deleted' ) as $status_param ) {
 			if ( isset( $prepared_args[ $status_param ] ) ) {
diff --git a/tests/phpunit/tests/rest-api/wpRestSitesController.php b/tests/phpunit/tests/rest-api/wpRestSitesController.php
index 753f1a6f79180..e66dcc33ad31f 100644
--- a/tests/phpunit/tests/rest-api/wpRestSitesController.php
+++ b/tests/phpunit/tests/rest-api/wpRestSitesController.php
@@ -106,6 +106,50 @@ public function test_get_items() {
 		$this->assertCount( 7, $sites );
 	}
 
+	/**
+	 * Without an explicit network filter, only sites on the current network are returned.
+	 *
+	 * @ticket 40365
+	 * @covers ::get_items
+	 * @group ms-required
+	 */
+	public function test_get_items_defaults_to_the_current_network() {
+		wp_set_current_user( self::$superadmin_id );
+
+		$current_network_site = self::factory()->blog->create( array( 'path' => '/current/' ) );
+
+		$other_network_id = self::factory()->network->create(
+			array(
+				'domain' => 'other-network.example.org',
+				'path'   => '/',
+			)
+		);
+
+		$other_network_site = self::factory()->blog->create(
+			array(
+				'domain'     => 'other-network.example.org',
+				'path'       => '/',
+				'network_id' => $other_network_id,
+			)
+		);
+
+		$request  = new WP_REST_Request( 'GET', '/wp/v2/sites' );
+		$response = rest_get_server()->dispatch( $request );
+
+		$this->assertEquals( 200, $response->get_status() );
+
+		$data     = $response->get_data();
+		$site_ids = wp_list_pluck( $data, 'id' );
+
+		$this->assertContains( $current_network_site, $site_ids, 'Sites on the current network should be returned.' );
+		$this->assertNotContains( $other_network_site, $site_ids, 'Sites on another network should not be returned.' );
+
+		$current_network_id = get_current_network_id();
+		foreach ( $data as $site ) {
+			$this->assertSame( $current_network_id, $site['network'], 'Every returned site should belong to the current network.' );
+		}
+	}
+
 	/**
 	 * @ticket 40365
 	 * @covers ::get_item