Ticket #16956: 16956.10.patch

src/wp-includes/capabilities-functions.php

@@ -53 +53 @@
                 }
 
                 $post_type = get_post_type_object( $post->post_type );
+                if ( ! $post_type ) {
+                        /* translators: 1: capability name, 2: post type */
+                        _doing_it_wrong( 'map_meta_cap', sprintf( __( 'Checked capability %1$s against unregistered post type %2$s' ), $cap, $post->post_type ), '4.4' );
+                        $caps[] = 'edit_others_posts';
+                        break;
+                }
 
                 if ( ! $post_type->map_meta_cap ) {
                         $caps[] = $post_type->cap->$cap;
@@ -101 +107 @@
                 }
 
                 $post_type = get_post_type_object( $post->post_type );
+                if ( ! $post_type ) {
+                        /* translators: 1: capability name, 2: post type */
+                        _doing_it_wrong( 'map_meta_cap', sprintf( __( 'Checked capability %1$s against unregistered post type %2$s' ), $cap, $post->post_type ), '4.4' );
+                        $caps[] = 'edit_others_posts';
+                        break;
+                }
 
                 if ( ! $post_type->map_meta_cap ) {
                         $caps[] = $post_type->cap->$cap;
@@ -143 +155 @@
                 }
 
                 $post_type = get_post_type_object( $post->post_type );
+                if ( ! $post_type ) {
+                        /* translators: 1: capability name, 2: post type */
+                        _doing_it_wrong( 'map_meta_cap', sprintf( __( 'Checked capability %1$s against unregistered post type %2$s' ), $cap, $post->post_type ), '4.4' );
+                        $caps[] = 'edit_others_posts';
+                        break;
+                }
 
                 if ( ! $post_type->map_meta_cap ) {
                         $caps[] = $post_type->cap->$cap;
@@ -169 +187 @@
         case 'publish_post':
                 $post = get_post( $args[0] );
                 $post_type = get_post_type_object( $post->post_type );
+                if ( ! $post_type ) {
+                        /* translators: 1: capability name, 2: post type */
+                        _doing_it_wrong( 'map_meta_cap', sprintf( __( 'Checked capability %1$s against unregistered post type %2$s' ), $cap, $post->post_type ), '4.4' );
+                        $caps[] = 'edit_others_posts';
+                        break;
+                }
 
                 $caps[] = $post_type->cap->publish_posts;
                 break;

tests/phpunit/tests/user/capabilities.php

@@ -994 +994 @@
 
                 $this->assertFalse( current_user_can( 'edit_user', $super_admin->ID ) );
         }
+
+        /**
+         * @ticket 16956
+         */
+        function test_require_edit_others_posts_if_post_type_doesnt_exist() {
+                register_post_type( 'existed' );
+                $post_id = $this->factory->post->create( array( 'post_type' => 'existed' ) );
+                _unregister_post_type( 'existed' );
+
+                $subscriber_id = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+                $editor_id = $this->factory->user->create( array( 'role' => 'editor' ) );
+
+                $this->setExpectedIncorrectUsage( 'map_meta_cap' );
+                foreach ( array( 'delete_post', 'edit_post', 'read_post', 'publish_post' ) as $cap ) {
+                        wp_set_current_user( $subscriber_id );
+                        $this->assertSame( array( 'edit_others_posts' ), map_meta_cap( $cap, $subscriber_id, $post_id ) );
+                        $this->assertFalse( current_user_can( $cap, $post_id ) );
+
+                        wp_set_current_user( $editor_id );
+                        $this->assertSame( array( 'edit_others_posts' ), map_meta_cap( $cap, $editor_id, $post_id ) );
+                        $this->assertTrue( current_user_can( $cap, $post_id ) );
+                }
+        }
 }