From 17ef6d8cfad4c74d351b28f82041a1bfa8f847da Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Fri, 30 Sep 2016 22:39:32 +0000 Subject: [PATCH] Taxonomy: Introduce more fine grained capabilities for managing taxonomy terms. This introduces the singular `edit_term`, `delete_term`, and `assign_term` meta capabilities for terms, and switches the base capability name for tags from `manage_categories` to `manage_post_tags` and the corresponding `edit_post_tags`, `delete_post_tags`, and `assign_post_tags`. All of these capabilities ultimately map to `manage_categories` so by default there is no change in the behaviour of the capabilities for categories, tags, or custom taxonomies. The `map_meta_cap` filter and the `capabilities` argument when registering a taxonomy now allow for control over editing, deleting, and assigning individual terms, as well as a separation of capabilities for tags from those of categories. Fixes #35614 Props johnjamesjacoby for feedback git-svn-id: https://develop.svn.wordpress.org/trunk@38698 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/edit-tags.php | 12 +-- src/wp-admin/includes/ajax-actions.php | 21 ++--- .../includes/class-wp-terms-list-table.php | 16 ++-- src/wp-admin/includes/meta-boxes.php | 2 + src/wp-admin/term.php | 4 +- src/wp-includes/admin-bar.php | 2 +- src/wp-includes/capabilities.php | 37 +++++++++ src/wp-includes/class-wp-xmlrpc-server.php | 25 +++--- src/wp-includes/link-template.php | 4 +- src/wp-includes/taxonomy.php | 12 +++ tests/phpunit/tests/user/capabilities.php | 78 +++++++++++++++++++ tests/phpunit/tests/xmlrpc/wp/deleteTerm.php | 2 +- tests/phpunit/tests/xmlrpc/wp/editTerm.php | 2 +- tests/phpunit/tests/xmlrpc/wp/getTerm.php | 2 +- 14 files changed, 173 insertions(+), 46 deletions(-) diff --git a/src/wp-admin/edit-tags.php b/src/wp-admin/edit-tags.php index 76e7204bd9..b048103a57 100644 --- a/src/wp-admin/edit-tags.php +++ b/src/wp-admin/edit-tags.php @@ -108,7 +108,7 @@ case 'delete': $tag_ID = (int) $_REQUEST['tag_ID']; check_admin_referer( 'delete-tag_' . $tag_ID ); - if ( ! current_user_can( $tax->cap->delete_terms ) ) { + if ( ! current_user_can( 'delete_term', $tag_ID ) ) { wp_die( '

' . __( 'Cheatin’ uh?' ) . '

' . '

' . __( 'Sorry, you are not allowed to delete this item.' ) . '

', @@ -168,7 +168,7 @@ case 'editedtag': $tag_ID = (int) $_POST['tag_ID']; check_admin_referer( 'update-tag_' . $tag_ID ); - if ( ! current_user_can( $tax->cap->edit_terms ) ) { + if ( ! current_user_can( 'edit_term', $tag_ID ) ) { wp_die( '

' . __( 'Cheatin’ uh?' ) . '

' . '

' . __( 'Sorry, you are not allowed to edit this item.' ) . '

', @@ -314,14 +314,6 @@ if ( 'category' == $taxonomy || 'link_category' == $taxonomy || 'post_tag' == $t require_once( ABSPATH . 'wp-admin/admin-header.php' ); -if ( ! current_user_can( $tax->cap->edit_terms ) ) { - wp_die( - '

' . __( 'Cheatin’ uh?' ) . '

' . - '

' . __( 'Sorry, you are not allowed to edit this item.' ) . '

', - 403 - ); -} - /** Also used by the Edit Tag form */ require_once( ABSPATH . 'wp-admin/includes/edit-tag-messages.php' ); diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php index 170eb96b06..1f6d7aa9d8 100644 --- a/src/wp-admin/includes/ajax-actions.php +++ b/src/wp-admin/includes/ajax-actions.php @@ -594,12 +594,11 @@ function wp_ajax_delete_tag() { $tag_id = (int) $_POST['tag_ID']; check_ajax_referer( "delete-tag_$tag_id" ); - $taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag'; - $tax = get_taxonomy($taxonomy); - - if ( !current_user_can( $tax->cap->delete_terms ) ) + if ( ! current_user_can( 'delete_term', $tag_id ) ) { wp_die( -1 ); + } + $taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag'; $tag = get_term( $tag_id, $taxonomy ); if ( !$tag || is_wp_error( $tag ) ) wp_die( 1 ); @@ -796,8 +795,10 @@ function wp_ajax_add_link_category( $action ) { if ( empty( $action ) ) $action = 'add-link-category'; check_ajax_referer( $action ); - if ( !current_user_can( 'manage_categories' ) ) + $tax = get_taxonomy( 'link_category' ); + if ( ! current_user_can( $tax->cap->manage_terms ) ) { wp_die( -1 ); + } $names = explode(',', wp_unslash( $_POST['newcat'] ) ); $x = new WP_Ajax_Response(); foreach ( $names as $cat_name ) { @@ -1703,14 +1704,16 @@ function wp_ajax_inline_save_tax() { if ( ! $tax ) wp_die( 0 ); - if ( ! current_user_can( $tax->cap->edit_terms ) ) + if ( ! isset( $_POST['tax_ID'] ) || ! ( $id = (int) $_POST['tax_ID'] ) ) { wp_die( -1 ); + } + + if ( ! current_user_can( 'edit_term', $id ) ) { + wp_die( -1 ); + } $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) ); - if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) ) - wp_die( -1 ); - $tag = get_term( $id, $taxonomy ); $_POST['description'] = $tag->description; diff --git a/src/wp-admin/includes/class-wp-terms-list-table.php b/src/wp-admin/includes/class-wp-terms-list-table.php index 257c44a64c..7d59624a20 100644 --- a/src/wp-admin/includes/class-wp-terms-list-table.php +++ b/src/wp-admin/includes/class-wp-terms-list-table.php @@ -151,7 +151,10 @@ class WP_Terms_List_Table extends WP_List_Table { */ protected function get_bulk_actions() { $actions = array(); - $actions['delete'] = __( 'Delete' ); + + if ( current_user_can( get_taxonomy( $this->screen->taxonomy )->cap->delete_terms ) ) { + $actions['delete'] = __( 'Delete' ); + } return $actions; } @@ -332,11 +335,10 @@ class WP_Terms_List_Table extends WP_List_Table { * @return string */ public function column_cb( $tag ) { - $default_term = get_option( 'default_' . $this->screen->taxonomy ); - - if ( current_user_can( get_taxonomy( $this->screen->taxonomy )->cap->delete_terms ) && $tag->term_id != $default_term ) + if ( current_user_can( 'delete_term', $tag->term_id ) ) { return '' . ''; + } return ' '; } @@ -423,8 +425,6 @@ class WP_Terms_List_Table extends WP_List_Table { $taxonomy = $this->screen->taxonomy; $tax = get_taxonomy( $taxonomy ); - $default_term = get_option( 'default_' . $taxonomy ); - $uri = wp_doing_ajax() ? wp_get_referer() : $_SERVER['REQUEST_URI']; $edit_link = add_query_arg( @@ -434,7 +434,7 @@ class WP_Terms_List_Table extends WP_List_Table { ); $actions = array(); - if ( current_user_can( $tax->cap->edit_terms ) ) { + if ( current_user_can( 'edit_term', $tag->term_id ) ) { $actions['edit'] = sprintf( '%s', esc_url( $edit_link ), @@ -449,7 +449,7 @@ class WP_Terms_List_Table extends WP_List_Table { __( 'Quick Edit' ) ); } - if ( current_user_can( $tax->cap->delete_terms ) && $tag->term_id != $default_term ) { + if ( current_user_can( 'delete_term', $tag->term_id ) ) { $actions['delete'] = sprintf( '%s', wp_nonce_url( "edit-tags.php?action=delete&taxonomy=$taxonomy&tag_ID=$tag->term_id", 'delete-tag_' . $tag->term_id ), diff --git a/src/wp-admin/includes/meta-boxes.php b/src/wp-admin/includes/meta-boxes.php index af1ee22136..c579bd918f 100644 --- a/src/wp-admin/includes/meta-boxes.php +++ b/src/wp-admin/includes/meta-boxes.php @@ -434,6 +434,8 @@ function post_tags_meta_box( $post, $box ) {

labels->separate_items_with_commas; ?>

+ +

labels->no_terms; ?>

diff --git a/src/wp-admin/term.php b/src/wp-admin/term.php index dc3f1d5fef..2018ac0415 100644 --- a/src/wp-admin/term.php +++ b/src/wp-admin/term.php @@ -31,11 +31,11 @@ $taxonomy = $tax->name; $title = $tax->labels->edit_item; if ( ! in_array( $taxonomy, get_taxonomies( array( 'show_ui' => true ) ) ) || - ! current_user_can( $tax->cap->manage_terms ) + ! current_user_can( 'edit_term', $tag->term_id ) ) { wp_die( '

' . __( 'Cheatin’ uh?' ) . '

' . - '

' . __( 'Sorry, you are not allowed to manage this item.' ) . '

', + '

' . __( 'Sorry, you are not allowed to edit this item.' ) . '

', 403 ); } diff --git a/src/wp-includes/admin-bar.php b/src/wp-includes/admin-bar.php index d562cc6693..1468e85153 100644 --- a/src/wp-includes/admin-bar.php +++ b/src/wp-includes/admin-bar.php @@ -635,7 +635,7 @@ function wp_admin_bar_edit_menu( $wp_admin_bar ) { ) ); } elseif ( ! empty( $current_object->taxonomy ) && ( $tax = get_taxonomy( $current_object->taxonomy ) ) - && current_user_can( $tax->cap->edit_terms ) + && current_user_can( 'edit_term', $current_object->term_id ) && $edit_term_link = get_edit_term_link( $current_object->term_id, $current_object->taxonomy ) ) { $wp_admin_bar->add_menu( array( diff --git a/src/wp-includes/capabilities.php b/src/wp-includes/capabilities.php index 15e9ef9870..841fba1488 100644 --- a/src/wp-includes/capabilities.php +++ b/src/wp-includes/capabilities.php @@ -402,6 +402,43 @@ function map_meta_cap( $cap, $user_id ) { case 'delete_site': $caps[] = 'manage_options'; break; + case 'edit_term': + case 'delete_term': + case 'assign_term': + $term_id = $args[0]; + $term = get_term( $term_id ); + if ( ! $term || is_wp_error( $term ) ) { + $caps[] = 'do_not_allow'; + break; + } + + $tax = get_taxonomy( $term->taxonomy ); + if ( ! $tax ) { + $caps[] = 'do_not_allow'; + break; + } + + if ( 'delete_term' === $cap && ( $term->term_id == get_option( 'default_' . $term->taxonomy ) ) ) { + $caps[] = 'do_not_allow'; + break; + } + + $taxo_cap = $cap . 's'; + + $caps = map_meta_cap( $tax->cap->$taxo_cap, $user_id, $term_id ); + + break; + case 'manage_post_tags': + case 'edit_categories': + case 'edit_post_tags': + case 'delete_categories': + case 'delete_post_tags': + $caps[] = 'manage_categories'; + break; + case 'assign_categories': + case 'assign_post_tags': + $caps[] = 'edit_posts'; + break; case 'create_sites': case 'delete_sites': case 'manage_network': diff --git a/src/wp-includes/class-wp-xmlrpc-server.php b/src/wp-includes/class-wp-xmlrpc-server.php index b08347f11c..528c74bf46 100644 --- a/src/wp-includes/class-wp-xmlrpc-server.php +++ b/src/wp-includes/class-wp-xmlrpc-server.php @@ -1886,8 +1886,9 @@ class wp_xmlrpc_server extends IXR_Server { $taxonomy = get_taxonomy( $content_struct['taxonomy'] ); - if ( ! current_user_can( $taxonomy->cap->manage_terms ) ) + if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) { return new IXR_Error( 401, __( 'Sorry, you are not allowed to create terms in this taxonomy.' ) ); + } $taxonomy = (array) $taxonomy; @@ -1973,9 +1974,6 @@ class wp_xmlrpc_server extends IXR_Server { $taxonomy = get_taxonomy( $content_struct['taxonomy'] ); - if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit terms in this taxonomy.' ) ); - $taxonomy = (array) $taxonomy; // hold the data of the term @@ -1989,6 +1987,10 @@ class wp_xmlrpc_server extends IXR_Server { if ( ! $term ) return new IXR_Error( 404, __( 'Invalid term ID.' ) ); + if ( ! current_user_can( 'edit_term', $term_id ) ) { + return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this term.' ) ); + } + if ( isset( $content_struct['name'] ) ) { $term_data['name'] = trim( $content_struct['name'] ); @@ -2068,10 +2070,6 @@ class wp_xmlrpc_server extends IXR_Server { return new IXR_Error( 403, __( 'Invalid taxonomy.' ) ); $taxonomy = get_taxonomy( $taxonomy ); - - if ( ! current_user_can( $taxonomy->cap->delete_terms ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete terms in this taxonomy.' ) ); - $term = get_term( $term_id, $taxonomy->name ); if ( is_wp_error( $term ) ) @@ -2080,6 +2078,10 @@ class wp_xmlrpc_server extends IXR_Server { if ( ! $term ) return new IXR_Error( 404, __( 'Invalid term ID.' ) ); + if ( ! current_user_can( 'delete_term', $term_id ) ) { + return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this term.' ) ); + } + $result = wp_delete_term( $term_id, $taxonomy->name ); if ( is_wp_error( $result ) ) @@ -2140,9 +2142,6 @@ class wp_xmlrpc_server extends IXR_Server { $taxonomy = get_taxonomy( $taxonomy ); - if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) - return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) ); - $term = get_term( $term_id , $taxonomy->name, ARRAY_A ); if ( is_wp_error( $term ) ) @@ -2151,6 +2150,10 @@ class wp_xmlrpc_server extends IXR_Server { if ( ! $term ) return new IXR_Error( 404, __( 'Invalid term ID.' ) ); + if ( ! current_user_can( 'assign_term', $term_id ) ) { + return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign this term.' ) ); + } + return $this->_prepare_term( $term ); } diff --git a/src/wp-includes/link-template.php b/src/wp-includes/link-template.php index 292c98ca80..c1ec8b33a9 100644 --- a/src/wp-includes/link-template.php +++ b/src/wp-includes/link-template.php @@ -930,7 +930,7 @@ function get_edit_term_link( $term_id, $taxonomy = '', $object_type = '' ) { } $tax = get_taxonomy( $term->taxonomy ); - if ( ! $tax || ! current_user_can( $tax->cap->edit_terms ) ) { + if ( ! $tax || ! current_user_can( 'edit_term', $term->term_id ) ) { return; } @@ -984,7 +984,7 @@ function edit_term_link( $link = '', $before = '', $after = '', $term = null, $e return; $tax = get_taxonomy( $term->taxonomy ); - if ( ! current_user_can( $tax->cap->edit_terms ) ) { + if ( ! current_user_can( 'edit_term', $term->term_id ) ) { return; } diff --git a/src/wp-includes/taxonomy.php b/src/wp-includes/taxonomy.php index a39fa47518..e2a5f81f6c 100644 --- a/src/wp-includes/taxonomy.php +++ b/src/wp-includes/taxonomy.php @@ -61,6 +61,12 @@ function create_initial_taxonomies() { 'show_ui' => true, 'show_admin_column' => true, '_builtin' => true, + 'capabilities' => array( + 'manage_terms' => 'manage_categories', + 'edit_terms' => 'edit_categories', + 'delete_terms' => 'delete_categories', + 'assign_terms' => 'assign_categories', + ), ) ); register_taxonomy( 'post_tag', 'post', array( @@ -71,6 +77,12 @@ function create_initial_taxonomies() { 'show_ui' => true, 'show_admin_column' => true, '_builtin' => true, + 'capabilities' => array( + 'manage_terms' => 'manage_post_tags', + 'edit_terms' => 'edit_post_tags', + 'delete_terms' => 'delete_post_tags', + 'assign_terms' => 'assign_post_tags', + ), ) ); register_taxonomy( 'nav_menu', 'nav_menu_item', array( diff --git a/tests/phpunit/tests/user/capabilities.php b/tests/phpunit/tests/user/capabilities.php index 9ba7f2e7be..c8989e1b5c 100644 --- a/tests/phpunit/tests/user/capabilities.php +++ b/tests/phpunit/tests/user/capabilities.php @@ -223,6 +223,15 @@ class Tests_User_Capabilities extends WP_UnitTestCase { 'customize' => array( 'administrator' ), 'delete_site' => array( 'administrator' ), 'add_users' => array( 'administrator' ), + + 'edit_categories' => array( 'administrator', 'editor' ), + 'delete_categories' => array( 'administrator', 'editor' ), + 'manage_post_tags' => array( 'administrator', 'editor' ), + 'edit_post_tags' => array( 'administrator', 'editor' ), + 'delete_post_tags' => array( 'administrator', 'editor' ), + + 'assign_categories' => array( 'administrator', 'editor', 'author', 'contributor' ), + 'assign_post_tags' => array( 'administrator', 'editor', 'author', 'contributor' ), ); } @@ -242,6 +251,15 @@ class Tests_User_Capabilities extends WP_UnitTestCase { 'customize' => array( 'administrator' ), 'delete_site' => array( 'administrator' ), 'add_users' => array( 'administrator' ), + + 'edit_categories' => array( 'administrator', 'editor' ), + 'delete_categories' => array( 'administrator', 'editor' ), + 'manage_post_tags' => array( 'administrator', 'editor' ), + 'edit_post_tags' => array( 'administrator', 'editor' ), + 'delete_post_tags' => array( 'administrator', 'editor' ), + + 'assign_categories' => array( 'administrator', 'editor', 'author', 'contributor' ), + 'assign_post_tags' => array( 'administrator', 'editor', 'author', 'contributor' ), ); } @@ -399,6 +417,9 @@ class Tests_User_Capabilities extends WP_UnitTestCase { $expected['delete_post_meta'], $expected['add_post_meta'], $expected['edit_comment'], + $expected['edit_term'], + $expected['delete_term'], + $expected['assign_term'], $expected['delete_user'] ); @@ -1078,6 +1099,63 @@ class Tests_User_Capabilities extends WP_UnitTestCase { } } + /** + * @dataProvider dataTaxonomies + * + * @ticket 35614 + */ + public function test_default_taxonomy_term_cannot_be_deleted( $taxonomy ) { + if ( ! taxonomy_exists( $taxonomy ) ) { + register_taxonomy( $taxonomy, 'post' ); + } + + $tax = get_taxonomy( $taxonomy ); + $user = self::$users['administrator']; + $term = self::factory()->term->create_and_get( array( + 'taxonomy' => $taxonomy, + ) ); + + update_option( "default_{$taxonomy}", $term->term_id ); + + $this->assertTrue( user_can( $user->ID, $tax->cap->delete_terms ) ); + $this->assertFalse( user_can( $user->ID, 'delete_term', $term->term_id ) ); + } + + /** + * @dataProvider dataTaxonomies + * + * @ticket 35614 + */ + public function test_taxonomy_caps_map_correctly_to_their_meta_cap( $taxonomy ) { + if ( ! taxonomy_exists( $taxonomy ) ) { + register_taxonomy( $taxonomy, 'post' ); + } + + $tax = get_taxonomy( $taxonomy ); + $term = self::factory()->term->create_and_get( array( + 'taxonomy' => $taxonomy, + ) ); + + foreach ( self::$users as $role => $user ) { + $this->assertSame( + user_can( $user->ID, 'edit_term', $term->term_id ), + user_can( $user->ID, $tax->cap->edit_terms ), + "Role: {$role}" + ); + $this->assertSame( + user_can( $user->ID, 'delete_term', $term->term_id ), + user_can( $user->ID, $tax->cap->delete_terms ), + "Role: {$role}" + ); + $this->assertSame( + user_can( $user->ID, 'assign_term', $term->term_id ), + user_can( $user->ID, $tax->cap->assign_terms ), + "Role: {$role}" + ); + } + + } + public function dataTaxonomies() { return array( array( diff --git a/tests/phpunit/tests/xmlrpc/wp/deleteTerm.php b/tests/phpunit/tests/xmlrpc/wp/deleteTerm.php index 6f738b1177..1132095373 100644 --- a/tests/phpunit/tests/xmlrpc/wp/deleteTerm.php +++ b/tests/phpunit/tests/xmlrpc/wp/deleteTerm.php @@ -43,7 +43,7 @@ class Tests_XMLRPC_wp_deleteTerm extends WP_XMLRPC_UnitTestCase { $result = $this->myxmlrpcserver->wp_deleteTerm( array( 1, 'subscriber', 'subscriber', 'category', $this->term['term_id'] ) ); $this->assertInstanceOf( 'IXR_Error', $result ); $this->assertEquals( 401, $result->code ); - $this->assertEquals( __( 'Sorry, you are not allowed to delete terms in this taxonomy.' ), $result->message ); + $this->assertEquals( __( 'Sorry, you are not allowed to delete this term.' ), $result->message ); } function test_empty_term() { diff --git a/tests/phpunit/tests/xmlrpc/wp/editTerm.php b/tests/phpunit/tests/xmlrpc/wp/editTerm.php index af8bd0bef9..db14a68434 100644 --- a/tests/phpunit/tests/xmlrpc/wp/editTerm.php +++ b/tests/phpunit/tests/xmlrpc/wp/editTerm.php @@ -49,7 +49,7 @@ class Tests_XMLRPC_wp_editTerm extends WP_XMLRPC_UnitTestCase { $result = $this->myxmlrpcserver->wp_editTerm( array( 1, 'subscriber', 'subscriber', $this->parent_term['term_id'], array( 'taxonomy' => 'category' ) ) ); $this->assertInstanceOf( 'IXR_Error', $result ); $this->assertEquals( 401, $result->code ); - $this->assertEquals( __( 'Sorry, you are not allowed to edit terms in this taxonomy.' ), $result->message ); + $this->assertEquals( __( 'Sorry, you are not allowed to edit this term.' ), $result->message ); } function test_term_not_exists() { diff --git a/tests/phpunit/tests/xmlrpc/wp/getTerm.php b/tests/phpunit/tests/xmlrpc/wp/getTerm.php index 3e7257b37b..627a88d4a4 100644 --- a/tests/phpunit/tests/xmlrpc/wp/getTerm.php +++ b/tests/phpunit/tests/xmlrpc/wp/getTerm.php @@ -43,7 +43,7 @@ class Tests_XMLRPC_wp_getTerm extends WP_XMLRPC_UnitTestCase { $result = $this->myxmlrpcserver->wp_getTerm( array( 1, 'subscriber', 'subscriber', 'category', $this->term['term_id'] ) ); $this->assertInstanceOf( 'IXR_Error', $result ); $this->assertEquals( 401, $result->code ); - $this->assertEquals( __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ), $result->message ); + $this->assertEquals( __( 'Sorry, you are not allowed to assign this term.' ), $result->message ); }