Ticket #36319: 36319.patch

src/wp-includes/capabilities.php

@@ -251 +251 @@
 
                 if ( $meta_key && ( has_filter( "auth_post_meta_{$meta_key}" ) || has_filter( "auth_post_{$post_type}_meta_{$meta_key}" ) ) ) {
                         /**
-                         * Filters whether the user is allowed to add post meta to a post.
+                         * auth_post_meta_{$meta_key} filters whether the user is allowed to edit post meta.
                          *
+                         * If the filter is left at false, the capability to add, edit, or delete post meta will 
+                         * be added to the mapped edit_post capabilities. 
+                         *
+                         * If the filter is set to true, only the mapped meta caps from edit_post will apply. 
+                         *
+                         * Use the auth_post_{$post_type}_meta_{$meta_key} filter to modify capabilities for
+                         * specific post types. 
+                         *
                          * The dynamic portion of the hook name, `$meta_key`, refers to the
                          * meta key passed to map_meta_cap().
                          *
@@ -268 +276 @@
                         $allowed = apply_filters( "auth_post_meta_{$meta_key}", false, $meta_key, $post->ID, $user_id, $cap, $caps );
 
                         /**
-                         * Filters whether the user is allowed to add post meta to a post of a given type.
+                         * auth_post_meta_{$meta_key} filters whether the user is allowed to edit post meta for
+                         * a post of a given type.
                          *
+                         * If the filter is left at false, the capability to add, edit, or delete post meta will 
+                         * be added to the mapped edit_post capabilities. 
+                         *
+                         * If the filter is set to true, only the mapped meta caps from edit_post will apply. 
+                         *
+                         * Use the auth_post_meta_{$meta_key} filter to modify capabilities for all types. 
+                         *
                          * The dynamic portions of the hook name, `$meta_key` and `$post_type`,
                          * refer to the meta key passed to map_meta_cap() and the post type, respectively.
                          *
@@ -284 +300 @@
                          */
                         $allowed = apply_filters( "auth_post_{$post_type}_meta_{$meta_key}", $allowed, $meta_key, $post->ID, $user_id, $cap, $caps );
 
-                        if ( ! $allowed )
+                        if ( ! $allowed ) {
                                 $caps[] = $cap;
+                        }
                 } elseif ( $meta_key && is_protected_meta( $meta_key, 'post' ) ) {
                         $caps[] = $cap;
                 }