vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 20:30:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use meta caps edit_post, read_post, and delete_post directly, rather than consulting the post type object. map_meta_cap() handles that for us. props markjaquith, kovshenin. fixes #23226.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@24593 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin
2013-07-08 20:05:42 +00:00
parent e16dca6fc9
commit f3b332e9bb
12 changed files with 28 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-includes/admin-bar.php
+2 -2
View File
@@ -429,7 +429,7 @@ function wp_admin_bar_edit_menu( $wp_admin_bar ) {
if ( 'post' == $current_screen->base
&& 'add' != $current_screen->action
&& ( $post_type_object = get_post_type_object( $post->post_type ) )
&& current_user_can( $post_type_object->cap->read_post, $post->ID )
&& current_user_can( 'read_post', $post->ID )
&& ( $post_type_object->public )
&& ( $post_type_object->show_in_admin_bar ) )
{
@@ -457,7 +457,7 @@ function wp_admin_bar_edit_menu( $wp_admin_bar ) {
if ( ! empty( $current_object->post_type )
&& ( $post_type_object = get_post_type_object( $current_object->post_type ) )
&& current_user_can( $post_type_object->cap->edit_post, $current_object->ID )
&& current_user_can( 'edit_post', $current_object->ID )
&& $post_type_object->show_ui && $post_type_object->show_in_admin_bar )
{
$wp_admin_bar->add_menu( array(
wp-includes/capabilities.php
+2 -5
View File
@@ -1162,8 +1162,7 @@ function map_meta_cap( $cap, $user_id ) {
case 'delete_post_meta':
case 'add_post_meta':
$post = get_post( $args[0] );
$post_type_object = get_post_type_object( $post->post_type );
$caps = map_meta_cap( $post_type_object->cap->edit_post, $user_id, $post->ID );
$caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
$meta_key = isset( $args[ 1 ] ) ? $args[ 1 ] : false;
@@ -1178,9 +1177,7 @@ function map_meta_cap( $cap, $user_id ) {
case 'edit_comment':
$comment = get_comment( $args[0] );
$post = get_post( $comment->comment_post_ID );
$post_type_object = get_post_type_object( $post->post_type );
$caps = map_meta_cap( $post_type_object->cap->edit_post, $user_id, $post->ID );
$caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
break;
case 'unfiltered_upload':
if ( defined('ALLOW_UNFILTERED_UPLOADS') && ALLOW_UNFILTERED_UPLOADS && ( !is_multisite() || is_super_admin( $user_id ) ) )
wp-includes/class-wp-xmlrpc-server.php
+4 -7
View File
@@ -1017,7 +1017,7 @@ class wp_xmlrpc_server extends IXR_Server {
if ( $update ) {
if ( ! get_post( $post_data['ID'] ) )
return new IXR_Error( 401, __( 'Invalid post ID.' ) );
if ( ! current_user_can( $post_type->cap->edit_post, $post_data['ID'] ) )
if ( ! current_user_can( 'edit_post', $post_data['ID'] ) )
return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
if ( $post_data['post_type'] != get_post_type( $post_data['ID'] ) )
return new IXR_Error( 401, __( 'The post type may not be changed.' ) );
@@ -1327,8 +1327,7 @@ class wp_xmlrpc_server extends IXR_Server {
if ( empty( $post['ID'] ) )
return new IXR_Error( 404, __( 'Invalid post ID.' ) );
$post_type = get_post_type_object( $post['post_type'] );
if ( ! current_user_can( $post_type->cap->delete_post, $post_id ) )
if ( ! current_user_can( 'delete_post', $post_id ) )
return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
$result = wp_delete_post( $post_id );
@@ -1409,8 +1408,7 @@ class wp_xmlrpc_server extends IXR_Server {
if ( empty( $post['ID'] ) )
return new IXR_Error( 404, __( 'Invalid post ID.' ) );
$post_type = get_post_type_object( $post['post_type'] );
if ( ! current_user_can( $post_type->cap->edit_post, $post_id ) )
if ( ! current_user_can( 'edit_post', $post_id ) )
return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
return $this->_prepare_post( $post, $fields );
@@ -1505,8 +1503,7 @@ class wp_xmlrpc_server extends IXR_Server {
$struct = array();
foreach ( $posts_list as $post ) {
$post_type = get_post_type_object( $post['post_type'] );
if ( ! current_user_can( $post_type->cap->edit_post, $post['ID'] ) )
if ( ! current_user_can( 'edit_post', $post['ID'] ) )
continue;
$struct[] = $this->_prepare_post( $post, $fields );
wp-includes/link-template.php
+2 -2
View File
@@ -906,7 +906,7 @@ function get_edit_post_link( $id = 0, $context = 'display' ) {
if ( !$post_type_object )
return;
if ( !current_user_can( $post_type_object->cap->edit_post, $post->ID ) )
if ( !current_user_can( 'edit_post', $post->ID ) )
return;
return apply_filters( 'get_edit_post_link', admin_url( sprintf($post_type_object->_edit_link . $action, $post->ID) ), $post->ID, $context );
@@ -960,7 +960,7 @@ function get_delete_post_link( $id = 0, $deprecated = '', $force_delete = false
if ( !$post_type_object )
return;
if ( !current_user_can( $post_type_object->cap->delete_post, $post->ID ) )
if ( !current_user_can( 'delete_post', $post->ID ) )
return;
$action = ( $force_delete || !EMPTY_TRASH_DAYS ) ? 'delete' : 'trash';
wp-includes/query.php
+3 -4
View File
@@ -2440,14 +2440,13 @@ class WP_Query {
$post_type_object = get_post_type_object ( 'post' );
}
$edit_cap = 'edit_post';
$read_cap = 'read_post';
if ( ! empty( $post_type_object ) ) {
$edit_cap = $post_type_object->cap->edit_post;
$read_cap = $post_type_object->cap->read_post;
$edit_others_cap = $post_type_object->cap->edit_others_posts;
$read_private_cap = $post_type_object->cap->read_private_posts;
} else {
$edit_cap = 'edit_' . $post_type_cap;
$read_cap = 'read_' . $post_type_cap;
$edit_others_cap = 'edit_others_' . $post_type_cap . 's';
$read_private_cap = 'read_private_' . $post_type_cap . 's';
}