Ticket #38284: 38284.diff

src/wp-includes/capabilities.php

@@ -51 +51 @@
                         $caps[] = 'edit_users'; // edit_user maps to edit_users.
                 }
                 break;
+        case 'edit_user_meta':
+        case 'delete_user_meta':
+        case 'add_user_meta':
+                $user = get_user_by( 'id', $args[0] );
+                if( ! $user ){
+                        $caps[] = 'do_not_allow';
+                        break;
+                }
+                
+                $caps = map_meta_cap( 'edit_user', $user_id, $user->ID );
+
+                $meta_key = isset( $args[ 1 ] ) ? $args[ 1 ] : false;
+
+                if ( $meta_key && ( has_filter( "auth_user_meta_{$meta_key}" ) ) ) {
+                        /**
+                         * Filters whether the user is allowed to add user meta to a user.
+                         *
+                         * The dynamic portion of the hook name, `$meta_key`, refers to the
+                         * meta key passed to map_meta_cap().
+                         *
+                         * @since 4.7.0
+                         *
+                         * @param bool   $allowed  Whether the user can add the user meta. Default false.
+                         * @param string $meta_key The meta key.
+                         * @param int    $user->ID The user being edited.
+                         * @param int    $user_id  User ID.
+                         * @param string $cap      Capability name.
+                         * @param array  $caps     User capabilities.
+                         */
+                        $allowed = apply_filters( "auth_user_meta_{$meta_key}", false, $meta_key, $user->ID, $user_id, $cap, $caps );
+        
+                        if ( ! $allowed ){
+                                $caps[] = $cap;
+                        }
+                }
+                break;
+
         case 'delete_post':
         case 'delete_page':
                 $post = get_post( $args[0] );
@@ -314 +351 @@
                         $caps = map_meta_cap( 'edit_posts', $user_id );
                 }
                 break;
+        case 'edit_comment_meta':
+        case 'delete_comment_meta':
+        case 'add_comment_meta':
+                $comment = get_comment( $args[0] );
+                if ( ! $comment ) {
+                        $caps[] = 'do_not_allow';
+                        break;
+                }
+
+                $caps = map_meta_cap( 'edit_comment', $user_id, $comment->comment_post_ID ); 
+                
+                $meta_key = isset( $args[ 1 ] ) ? $args[ 1 ] : false;
+
+                if ( $meta_key && ( has_filter( "auth_comment_meta_{$meta_key}" ) ) ) {
+                        /**
+                         * Filters whether the user is allowed to add comment meta to a comment.
+                         *
+                         * The dynamic portion of the hook name, `$meta_key`, refers to the
+                         * meta key passed to map_meta_cap().
+                         *
+                         * @since 4.7.0
+                         *
+                         * @param bool   $allowed  Whether the user can add the comment meta. Default false.
+                         * @param string $meta_key The meta key.
+                         * @param int    $comment_id  Post ID.
+                         * @param int    $user_id  User ID.
+                         * @param string $cap      Capability name.
+                         * @param array  $caps     User capabilities.
+                         */
+                        $allowed = apply_filters( "auth_comment_meta_{$meta_key}", false, $meta_key, $comment->comment_post_ID, $user_id, $cap, $caps );
+        
+                        if ( ! $allowed ){
+                                $caps[] = $cap;
+                        }
+                }
+                break;
         case 'unfiltered_upload':
                 if ( defined('ALLOW_UNFILTERED_UPLOADS') && ALLOW_UNFILTERED_UPLOADS && ( !is_multisite() || is_super_admin( $user_id ) )  )
                         $caps[] = $cap;
@@ -428 +501 @@
                 $caps = map_meta_cap( $tax->cap->$taxo_cap, $user_id, $term_id );
 
                 break;
+        case 'edit_term_meta':
+        case 'delete_term_meta':
+        case 'add_term_meta':
+                $term_id = $args[0];
+                $term = get_term( $term_id );
+                if ( ! $term || is_wp_error( $term ) ) {
+                        $caps[] = 'do_not_allow';
+                        break;
+                }
+
+                $caps = map_meta_cap( 'edit_term', $user_id, $term_id ); 
+
+                $meta_key = isset( $args[ 1 ] ) ? $args[ 1 ] : false;
+
+                if ( $meta_key && ( has_filter( "auth_term_meta_{$meta_key}" ) ) ) {
+                        /**
+                         * Filters whether the user is allowed to add comment meta to a comment.
+                         *
+                         * The dynamic portion of the hook name, `$meta_key`, refers to the
+                         * meta key passed to map_meta_cap().
+                         *
+                         * @since 4.7.0
+                         *
+                         * @param bool   $allowed  Whether the user can add the comment meta. Default false.
+                         * @param string $meta_key The meta key.
+                         * @param int    $comment_id  Post ID.
+                         * @param int    $user_id  User ID.
+                         * @param string $cap      Capability name.
+                         * @param array  $caps     User capabilities.
+                         */
+                        $allowed = apply_filters( "auth_term_meta_{$meta_key}", false, $meta_key, $term_id, $user_id, $cap, $caps );
+        
+                        if ( ! $allowed ){
+                                $caps[] = $cap;
+                        }
+                }
+                break;
+
         case 'manage_post_tags':
         case 'edit_categories':
         case 'edit_post_tags':

tests/phpunit/tests/user/capabilities.php

@@ -406 +406 @@
                         $expected['remove_user'],
                         $expected['promote_user'],
                         $expected['edit_user'],
+                        $expected['edit_user_meta'],
+                        $expected['delete_user_meta'],
+                        $expected['add_user_meta'],                     
                         $expected['delete_post'],
                         $expected['delete_page'],
                         $expected['edit_post'],
@@ -417 +420 @@
                         $expected['delete_post_meta'],
                         $expected['add_post_meta'],
                         $expected['edit_comment'],
+                        $expected['edit_comment_meta'],
+                        $expected['delete_comment_meta'],
+                        $expected['add_comment_meta'],
                         $expected['edit_term'],
                         $expected['delete_term'],
                         $expected['assign_term'],
+                        $expected['edit_term_meta'],
+                        $expected['delete_term_meta'],
+                        $expected['add_term_meta'],                     
                         $expected['delete_user']
                 );