sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Capabilities: When creating an auto-draft, ensure that the current user still has permission to do so.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@33357 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Gary Pendergast 2015-07-22 04:01:53 +00:00
parent 2533d76203
commit 7439dd7354
4 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/wp-admin/includes/dashboard.php
View File

@ -442,6 +442,10 @@ function wp_network_dashboard_right_now() {
function wp_dashboard_quick_press( $error_msg = false ) {
global $post_ID;
if ( ! current_user_can( 'edit_posts' ) ) {
return;
}
/* Check if a new auto-draft (= no new post_ID) is needed or if the old can be used */
$last_post_id = (int) get_user_option( 'dashboard_quick_press_last_post_id' ); // Get the last post_ID
if ( $last_post_id ) {

5
src/wp-admin/post.php
View File

@ -120,8 +120,9 @@ case 'post-quickdraft-save':
if ( ! wp_verify_nonce( $nonce, 'add-post' ) )
$error_msg = __( 'Unable to submit this form, please refresh and try again.' );
if ( ! current_user_can( 'edit_posts' ) )
$error_msg = __( 'Oops, you don’t have access to add new drafts.' );
if ( ! current_user_can( 'edit_posts' ) ) {
exit;
}
if ( $error_msg )
return wp_dashboard_quick_press( $error_msg );

4
src/wp-includes/capabilities.php
View File

@ -1188,8 +1188,10 @@ function map_meta_cap( $cap, $user_id ) {
case 'edit_post':
case 'edit_page':
$post = get_post( $args[0] );
if ( empty( $post ) )
if ( empty( $post ) ) {
$caps[] = 'do_not_allow';
break;
}
if ( 'revision' == $post->post_type ) {
$post = get_post( $post->post_parent );

10
tests/phpunit/tests/user/capabilities.php
View File

@ -926,4 +926,14 @@ class Tests_User_Capabilities extends WP_UnitTestCase {
$user->remove_cap( 'publish_pages' );
$this->assertFalse( $user->has_cap( 'publish_pages' ) );
}
function test_subscriber_cant_edit_posts() {
$user = new WP_User( $this->factory->user->create( array( 'role' => 'subscriber' ) ) );
wp_set_current_user( $user->ID );
$post = $this->factory->post->create( array( 'post_author' => 1 ) );
$this->assertFalse( current_user_can( 'edit_post', $post ) );
$this->assertFalse( current_user_can( 'edit_post', $post + 1 ) );
}
}