vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 20:30:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't default to current user for capability checks when dealing with a post without an author (post_author = 0).

Browse Source 
Undoes [12053]. While it risks breakage, this is a far safer and saner default for these situations.

props danielbachhuber.
fixes #27020.


git-svn-id: https://develop.svn.wordpress.org/trunk@27390 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin
2014-03-04 03:08:54 +00:00
parent 1329d5ebc0
commit 5edec1d792
3 changed files with 59 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phpunit/tests/user/capabilities.php
+27
View File
@@ -524,6 +524,33 @@ class Tests_User_Capabilities extends WP_UnitTestCase {
}
}
function authorless_post_statuses() {
return array( array( 'draft' ), array( 'private' ), array( 'publish' ) );
}
/**
* @ticket 27020
* @dataProvider authorless_post_statuses
*/
function test_authorless_post( $status ) {
// Make a post without an author
$post = $this->factory->post->create( array( 'post_author' => 0, 'post_type' => 'post', 'post_status' => $status ) );
// Add an editor and contributor
$editor = $this->factory->user->create_and_get( array( 'role' => 'editor' ) );
$contributor = $this->factory->user->create_and_get( array( 'role' => 'contributor' ) );
// editor can edit, view, and trash
$this->assertTrue( $editor->has_cap( 'edit_post', $post ) );
$this->assertTrue( $editor->has_cap( 'delete_post', $post ) );
$this->assertTrue( $editor->has_cap( 'read_post', $post ) );
// a contributor cannot (except read a published post)
$this->assertFalse( $contributor->has_cap( 'edit_post', $post ) );
$this->assertFalse( $contributor->has_cap( 'delete_post', $post ) );
$this->assertEquals( $status === 'publish', $contributor->has_cap( 'read_post', $post ) );
}
/**
* @ticket 16714
*/
tests/phpunit/tests/user/mapMetaCap.php
+14
View File
@@ -232,4 +232,18 @@ class Tests_User_MapMetaCap extends WP_UnitTestCase {
$this->assertEquals( array( 'update_core' ), map_meta_cap( 'update_core', $this->user_id ) );
$this->assertEquals( array( 'edit_plugins' ), map_meta_cap( 'edit_plugins', $this->user_id ) );
}
/**
* Test a post without an author.
*
* @ticket 27020
*/
function test_authorless_posts_capabilties() {
$post_id = $this->factory->post->create( array( 'post_author' => 0, 'post_type' => 'post', 'post_status' => 'publish' ) );
$editor = $this->factory->user->create( array( 'role' => 'editor' ) );
$this->assertEquals( array( 'edit_others_posts', 'edit_published_posts' ), map_meta_cap( 'edit_post', $editor, $post_id ) );
$this->assertEquals( array( 'delete_others_posts', 'delete_published_posts' ), map_meta_cap( 'delete_post', $editor, $post_id ) );
}
}