Ticket #17850: 17850.3.diff

wp-includes/meta.php

@@ -588 +588 @@
  * @return bool True if the key is protected, false otherwise.
  */
 function is_protected_meta( $meta_key, $meta_type = null ) {
-        $protected = (  '_' == $meta_key[0] );
+        $protected = false;
+        $protected_keys = array( '_edit_last', '_edit_lock', '_thumbnail_id' );
 
+        if ( 0 === strpos( $meta_key, '_wp_' ) || 0 === strpos( $meta_key, '_menu_item_' ) ||
+                0 === strpos( $meta_key, '__' ) || in_array( $meta_key, $protected_keys ) )
+                $protected = true;
+
         return apply_filters( 'is_protected_meta', $protected, $meta_key, $meta_type );
 }
 
 /**
+ * Determine whether a meta key is hidden
+ *
+ * @since 3.2.0
+ *
+ * @param string $meta_key Meta key
+ * @return bool True if the key is hidden, false otherwise.
+ */
+function is_hidden_meta( $meta_key, $meta_type = null ) {
+        $hidden = (  '_' == $meta_key[0] );
+
+        return apply_filters( 'is_hidden_meta', $hidden, $meta_key, $meta_type );
+}
+
+/**
  * Sanitize meta value
  *
  * @since 3.1.3

wp-admin/admin-ajax.php

@@ -396 +396 @@
         if ( !$meta = get_post_meta_by_id( $id ) )
                 die('1');
 
-        if ( !current_user_can( 'edit_post', $meta->post_id ) || is_protected_meta( $meta->meta_key ) )
+        if ( !current_user_can( 'edit_post', $meta->post_id ) || is_hidden_meta( $meta->meta_key ) || is_protected_meta( $meta->meta_key ) )
                 die('-1');
         if ( delete_meta( $meta->meta_id ) )
                 die('1');
@@ -870 +870 @@
                         die('0'); // if meta doesn't exist
                 if ( !current_user_can( 'edit_post', $meta->post_id ) )
                         die('-1');
-                if ( is_protected_meta( $meta->meta_key ) )
+                if ( is_hidden_meta( $meta->meta_key ) || is_protected_meta( $meta->meta_key ) )
                         die('-1');
                 if ( $meta->meta_value != stripslashes($value) || $meta->meta_key != stripslashes($key) ) {
                         if ( !$u = update_meta( $mid, $key, $value ) )

wp-admin/includes/post.php

@@ -207 +207 @@
                                 continue;
                         if ( $meta->post_id != $post_ID )
                                 continue;
-                        if ( is_protected_meta( $value['key'] ) )
+                        if ( is_hidden_meta( $value['key'] ) || is_protected_meta( $value['key'] ) )
                                 continue;
                         update_meta( $key, $value['key'], $value['value'] );
                 }
@@ -219 +219 @@
                                 continue;
                         if ( $meta->post_id != $post_ID )
                                 continue;
-                        if ( is_protected_meta( $meta->meta_key ) )
+                        if ( is_hidden_meta( $meta->meta_key ) || is_protected_meta( $meta->meta_key ) )
                                 continue;
                         delete_meta( $key );
                 }
@@ -662 +662 @@
                 if ( $metakeyinput)
                         $metakey = $metakeyinput; // default
 
-                if ( is_protected_meta( $metakey ) )
+                if ( is_hidden_meta( $metakey ) || is_protected_meta( $metakey ) )
                         return false;
 
                 wp_cache_delete($post_ID, 'post_meta');