Ticket #38293: 38293.diff

src/wp-admin/includes/post.php

@@ -288 +288 @@
                                 continue;
                         if ( $meta->post_id != $post_ID )
                                 continue;
+                        if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $meta->meta_key ) )
+                                continue;
                         if ( is_protected_meta( $value['key'], 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $value['key'] ) )
                                 continue;
                         update_meta( $key, $value['key'], $value['value'] );

tests/phpunit/tests/post/meta.php

@@ -9 +9 @@
                 parent::setUp();
 
                 $this->author = new WP_User( self::factory()->user->create( array( 'role' => 'editor' ) ) );
+                $this->another_author = new WP_User( self::factory()->user->create( array( 'role' => 'editor' ) ) );
 
                 $post = array(
                         'post_author' => $this->author->ID,
@@ -237 +238 @@
                 $this->assertEquals($funky_meta, get_post_meta($this->post_id, 'test_funky_post_meta', true));
 
         }
+
+        /**
+         * @ticket 38293
+         */
+        public function test_user_cant_delete_another_users_protected_meta() {
+                require_once( ABSPATH . '/wp-admin/includes/post.php' );
+
+                $protected_meta_key = '_test_meta_data_that_is_protected_and_another_user_is_trying_to_delete';
+
+                // Add protected some meta data.
+                $post_id = $this->post_id;
+                $meta_id = add_post_meta( $post_id, $protected_meta_key, 'protected' );
+
+                // Other user editing the post should not effect outcome.
+                $expected = get_post_meta( $post_id, $protected_meta_key );
+
+                // Attempt to edit the post as another user.
+                wp_set_current_user( $this->another_author->ID );
+                $post_data = array(
+                        'post_ID' => $post_id,
+                        'meta' => array(
+                                "{$meta_id}" => array(
+                                        'key' => 'unprotected_meta_key',
+                                        'value' => 'protected',
+                                ),
+                        ),
+                );
+                edit_post( $post_data );
+                // Revert current user.
+                wp_set_current_user( 0 );
+
+                $actual = get_post_meta( $post_id, $protected_meta_key );
+                $this->assertSame( $expected, $actual );
+
+                // Tidy up.
+                delete_metadata_by_mid( 'post', $meta_id );
+        }
+
 }