vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-13 05:10:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Role/Capability: Use meta caps edit_post, read_post, and delete_post directly.

Browse Source 
Rather than consulting the post type object, let `map_meta_cap()` handle that for us.

Props peterwilsoncc, ocean90.
Fixes #50128.
See #23226.

git-svn-id: https://develop.svn.wordpress.org/trunk@47850 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Dominik Schilling
2020-05-23 15:22:53 +00:00
parent 584df2a169
commit f37a28858d
8 changed files with 17 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php
+6 -11
View File
@@ -109,17 +109,12 @@ class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {
}
// Attaching media to a post requires ability to edit said post.
if ( ! empty( $request['post'] ) ) {
$parent = get_post( (int) $request['post'] );
$post_parent_type = get_post_type_object( $parent->post_type );
if ( ! current_user_can( $post_parent_type->cap->edit_post, $request['post'] ) ) {
return new WP_Error(
'rest_cannot_edit',
__( 'Sorry, you are not allowed to upload media to this post.' ),
array( 'status' => rest_authorization_required_code() )
);
}
if ( ! empty( $request['post'] ) && ! current_user_can( 'edit_post', (int) $request['post'] ) ) {
return new WP_Error(
'rest_cannot_edit',
__( 'Sorry, you are not allowed to upload media to this post.' ),
array( 'status' => rest_authorization_required_code() )
);
}
return true;