Ticket #22711: 22711.diff

wp-includes/media.php

@@ -1335 +1335 @@
                 'dateFormatted' => mysql2date( get_option('date_format'), $attachment->post_date ),
                 'nonces'      => array(
                         'update' => wp_create_nonce( 'update-post_' . $attachment->ID ),
-                        'delete' => wp_create_nonce( 'delete-post_' . $attachment->ID ),
+                        'delete' => false,
                 ),
         );
 
+        if ( current_user_can( 'delete_post', $attachment->ID ) )
+                $response['nonces']['delete'] = wp_create_nonce( 'delete-post_' . $attachment->ID );
+
         if ( $meta && 'image' === $type ) {
                 $sizes = array();
                 $possible_sizes = apply_filters( 'image_size_names_choose', array(
@@ -1690 +1693 @@
                                 <# if ( 'image' === data.type && ! data.uploading && data.width && data.height ) { #>
                                         <div class="dimensions">{{ data.width }} &times; {{ data.height }}</div>
                                 <# } #>
-                                <# if ( ! data.uploading ) { #>
+                                <# if ( ! data.uploading && data.nonces['delete'] ) { #>
                                         <div class="delete-attachment">
                                                 <a href="#"><?php _e( 'Delete Permanently' ); ?></a>
                                         </div>