Ticket #38412: 38412.5.diff

src/wp-includes/capabilities.php

@@ -297 +297 @@
                         break;
                 }
 
-                $caps = map_meta_cap( "edit_{$object_type}", $user_id, $object_id );
-
                 $meta_key = isset( $args[1] ) ? $args[1] : false;
 
                 $has_filter = has_filter( "auth_{$object_type}_meta_{$meta_key}" ) || has_filter( "auth_{$object_type}_{$sub_type}_meta_{$meta_key}" );
@@ -314 +312 @@
                         }
                 } elseif ( $meta_key && is_protected_meta( $meta_key, $object_type ) ) {
                         $caps[] = $cap;
+                } else {
+                        $caps = map_meta_cap( "edit_{$object_type}", $user_id, $object_id );
                 }
                 break;
         case 'edit_comment':

src/wp-includes/meta.php

@@ -1034 +1034 @@
         $args = apply_filters( 'register_meta_args', $args, $defaults, $object_type, $meta_key );
         $args = wp_parse_args( $args, $defaults );
 
-        // If `auth_callback` is not provided, fall back to `is_protected_meta()`.
-        if ( empty( $args['auth_callback'] ) ) {
-                if ( is_protected_meta( $meta_key, $object_type ) ) {
-                        $args['auth_callback'] = '__return_false';
-                } else {
-                        $args['auth_callback'] = '__return_true';
-                }
-        }
-
         // Back-compat: old sanitize and auth callbacks are applied to all of an object type.
         if ( is_callable( $args['sanitize_callback'] ) ) {
                 add_filter( "sanitize_{$object_type}_meta_{$meta_key}", $args['sanitize_callback'], 10, 3 );

tests/phpunit/tests/meta/registerMeta.php

@@ -4 +4 @@
  */
 class Tests_Meta_Register_Meta extends WP_UnitTestCase {
         protected static $post_id;
+        protected static $users;
 
         public static function wpSetUpBeforeClass( $factory ) {
                 self::$post_id = $factory->post->create();
+                self::$users = array(
+                        'administrator' => $factory->user->create_and_get( array( 'role' => 'administrator' ) ),
+                        'subscriber'        => $factory->user->create_and_get( array( 'role' => 'subscriber' ) ),
+                );
         }
 
         public function _old_sanitize_meta_cb( $meta_value, $meta_key, $meta_type ) {
@@ -74 +79 @@
                                         'description' => '',
                                         'single' => false,
                                         'sanitize_callback' => null,
-                                        'auth_callback' => '__return_true',
+                                        'auth_callback' => null,
                                         'show_in_rest' => false,
                                 ),
                         ),
@@ -96 +101 @@
                                         'description' => '',
                                         'single' => false,
                                         'sanitize_callback' => null,
-                                        'auth_callback' => '__return_true',
+                                        'auth_callback' => null,
                                         'show_in_rest' => false,
                                 ),
                         ),
@@ -148 +153 @@
                                         'description' => '',
                                         'single' => false,
                                         'sanitize_callback' => array( $this, '_new_sanitize_meta_cb' ),
-                                        'auth_callback' => '__return_true',
+                                        'auth_callback' => null,
                                         'show_in_rest' => false,
                                 ),
                         ),
@@ -172 +177 @@
                 $this->assertEquals( 'new_sanitized_key new sanitized', $meta );
         }
 
+        public function test_register_meta_with_new_auth_callback_parameter() {
+
+                wp_set_current_user(  self::$users['subscriber']->ID ); 
+                
+                register_meta( 'post', 'no_auth_cb_1', array() ); 
+                $subscriber_can_update = false; 
+                if( current_user_can( 'edit_post_meta', self::$post_id, 'no_auth_cb_1' ) ){ 
+                        $subscriber_can_update = update_post_meta( self::$post_id, 'no_auth_cb_1', 'bar1' ); 
+                } 
+                unregister_meta_key( 'post', 'no_auth_cb_1' ); 
+                $this->assertFalse( $subscriber_can_update ); 
+
+                register_meta( 'post', 'auth_cb_true', array( 'auth_callback' =>  '__return_true' ) ); 
+                $subscriber_can_update = false; 
+                if( current_user_can( 'edit_post_meta', self::$post_id, 'auth_cb_true' ) ){ 
+                        $subscriber_can_update = update_post_meta( self::$post_id, 'auth_cb_true', 'bar1' ); 
+                } 
+                unregister_meta_key( 'post', 'auth_cb_true' ); 
+                $this->assertNotEmpty( $subscriber_can_update ); 
+                
+                wp_set_current_user( self::$users['administrator']->ID );
+
+                register_meta( 'post', 'no_auth_cb_2', array() ); 
+                $admin_can_update = false; 
+                if( current_user_can( 'edit_post_meta', self::$post_id, 'no_auth_cb_2' ) ){ 
+                        $admin_can_update = update_post_meta( self::$post_id, 'no_auth_cb_2', 'bar2' ); 
+                } 
+                unregister_meta_key( 'post', 'no_auth_cb_2' ); 
+                $this->assertNotEmpty( $admin_can_update );
+            
+                register_meta( 'post', 'auth_cb_false', array( 'auth_callback' => '__return_false' ) ); 
+                $admin_can_update = false; 
+                if( current_user_can( 'edit_post_meta', self::$post_id, 'auth_cb_false' ) ){ 
+                        $admin_can_update = update_post_meta( self::$post_id, 'auth_cb_false', 'bar2' ); 
+                } 
+                unregister_meta_key( 'post', 'auth_cb_false' ); 
+                $this->assertFalse( $admin_can_update ); 
+        }
+
         public function test_register_meta_unregistered_meta_key_removes_sanitize_filter() {
                 register_meta( 'post', 'new_sanitized_key', array( 'sanitize_callback' => array( $this, '_new_sanitize_meta_cb' ) ) );
                 unregister_meta_key( 'post', 'new_sanitized_key' );