sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Posts, Post Types: Prevent users from being able to delete a protected meta field from a post.

Browse Source 
Previously a user could remove a protected meta field by using their browser developer tools to alter the form field properties in the Custom Fields meta box, given that they know the ID of the protected meta field. This change prevents this by preventing any change to a protected meta field, including changing its key.

Props ajoah, johnbillion, peterwilsoncc
Fixes #38293


git-svn-id: https://develop.svn.wordpress.org/trunk@39062 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
John Blackbourn 2016-10-31 19:29:07 +00:00
parent 0e609fa717
commit d1707d6542
2 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-admin/includes/post.php
View File

@ -288,6 +288,8 @@ function edit_post( $post_data = null ) {
continue;
if ( $meta->post_id != $post_ID )
continue;
if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $meta->meta_key ) )
continue;
if ( is_protected_meta( $value['key'], 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $value['key'] ) )
continue;
update_meta( $key, $value['key'], $value['value'] );

35
tests/phpunit/tests/admin/includesPost.php
View File

@ -244,6 +244,40 @@ class Tests_Admin_Includes_Post extends WP_UnitTestCase {
$this->assertEquals( 'closed', $post->ping_status );
}
/**
* @ticket 38293
*/
public function test_user_cant_delete_protected_meta() {
$protected_meta_key = '_test_meta_data_that_is_protected';
// Add some protected meta data.
$post_id = self::$post_id;
$meta_id = add_post_meta( $post_id, $protected_meta_key, 'protected' );
// User editing the post should not effect outcome.
$expected = get_post_meta( $post_id, $protected_meta_key );
// Attempt to edit the post.
wp_set_current_user( self::$admin_id );
$post_data = array(
'post_ID' => $post_id,
'meta' => array(
$meta_id => array(
'key' => 'unprotected_meta_key',
'value' => 'protected',
),
),
);
edit_post( $post_data );
$actual = get_post_meta( $post_id, $protected_meta_key );
$this->assertSame( $expected, $actual );
// Tidy up.
delete_metadata_by_mid( 'post', $meta_id );
}
/**
* @ticket 30910
*/
@ -598,4 +632,5 @@ class Tests_Admin_Includes_Post extends WP_UnitTestCase {
$this->assertSame( $p, post_exists( $title, $content, $date ) );
}
}