diff --git a/src/wp-includes/capabilities.php b/src/wp-includes/capabilities.php index 38287dc7c3..f05c504cc1 100644 --- a/src/wp-includes/capabilities.php +++ b/src/wp-includes/capabilities.php @@ -241,6 +241,13 @@ function map_meta_cap( $cap, $user_id, ...$args ) { } $status_obj = get_post_status_object( $post->post_status ); + if ( ! $status_obj ) { + /* translators: 1: Post status, 2: Capability name. */ + _doing_it_wrong( __FUNCTION__, sprintf( __( 'The post status %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post with that status.' ), $post->post_status, $cap ), '5.4.0' ); + $caps[] = 'edit_others_posts'; + break; + } + if ( $status_obj->public ) { $caps[] = $post_type->cap->read; break; diff --git a/tests/phpunit/tests/user/capabilities.php b/tests/phpunit/tests/user/capabilities.php index 4e4ea12035..a5b7f3c55d 100644 --- a/tests/phpunit/tests/user/capabilities.php +++ b/tests/phpunit/tests/user/capabilities.php @@ -1773,6 +1773,29 @@ class Tests_User_Capabilities extends WP_UnitTestCase { } } + /** + * @ticket 48653 + * @expectedIncorrectUsage map_meta_cap + */ + function test_require_edit_others_posts_if_post_status_doesnt_exist() { + register_post_status( 'existed' ); + $post_id = self::factory()->post->create( array( 'post_status' => 'existed' ) ); + _unregister_post_status( 'existed' ); + + $subscriber_id = self::$users['subscriber']->ID; + $editor_id = self::$users['editor']->ID; + + foreach ( array( 'read_post', 'read_page' ) as $cap ) { + wp_set_current_user( $subscriber_id ); + $this->assertSame( array( 'edit_others_posts' ), map_meta_cap( $cap, $subscriber_id, $post_id ) ); + $this->assertFalse( current_user_can( $cap, $post_id ) ); + + wp_set_current_user( $editor_id ); + $this->assertSame( array( 'edit_others_posts' ), map_meta_cap( $cap, $editor_id, $post_id ) ); + $this->assertTrue( current_user_can( $cap, $post_id ) ); + } + } + /** * @ticket 17253 */