Ticket #40922: 40922.5.diff

src/wp-includes/capabilities.php

@@ -862 +862 @@
 
         return $allcaps;
 }
+
+function wp_maybe_grant_customize_changeset_caps( $allcaps, $caps, $args, $user ) {
+        global $post_type_meta_caps;
+
+        $changeset_post_type = get_post_type_object( 'customize_changeset' );
+
+        // Do something only when the capability type is the default.
+        if ( ( $changeset_post_type instanceof WP_Post_Type ) && ( 'customize_changeset' === $changeset_post_type->capability_type ) ) {
+                $changeset_caps = get_object_vars( $changeset_post_type->cap );
+
+                // Reduce $changeset_caps to post type primitives.
+                unset( $changeset_caps['read'] );
+                foreach ( $changeset_caps as $key => $cap ) {
+                        if ( isset( $post_type_meta_caps[ $cap ] ) ) {
+                                unset( $changeset_caps[ $key ] );
+                        }
+                }
+
+                // Do something only when at least one of the required $caps is a changeset primitive.
+                if ( array_intersect( array_values( $changeset_caps ), $caps ) ) {
+                        // All changeset capabilities were previously 'customize'.
+                        $user_can_args = array( $user->ID, 'customize' );
+
+                        /*
+                         * For compatibility with cases when 'customize' was passed a post
+                         * ID, also pass $args if the object ID corresponds to a changeset.
+                         */
+                        if (
+                                isset( $args[2] )
+                                && is_numeric( $args[2] )
+                                && ( intval( $args[2] ) > 0 )
+                                && ( 'customize_changeset' === get_post_type( $args[2] ) )
+                        ) {
+                                $user_can_args = array_merge( $user_can_args, array_slice( $args, 2 ) );
+                        }
+
+                        /*
+                         * Avoid an infinite loop if 'customize' has been mapped to a
+                         * changeset primitive. But note that if 'customize' *is* mapped to
+                         * any changeset primitives, then this function won't be hooked in
+                         * to dynamically grant the user those primitives.
+                         */
+                        remove_filter( 'user_has_cap', 'wp_maybe_grant_customize_changeset_caps', 1, 4 );
+                        $user_can = call_user_func_array( 'user_can', $user_can_args );
+                        add_filter( 'user_has_cap', 'wp_maybe_grant_customize_changeset_caps', 1, 4 );
+
+                        $allcaps = array_merge(
+                                $allcaps,
+                                array_fill_keys( array_values( $changeset_caps ), $user_can )
+                        );
+                }
+        }
+
+        return $allcaps;
+}
+add_filter( 'user_has_cap', 'wp_maybe_grant_customize_changeset_caps', 1, 4 );

src/wp-includes/post.php

@@ -176 +176 @@
                 'delete_with_user' => false,
                 'supports' => array( 'title', 'author' ),
                 'capability_type' => 'customize_changeset',
-                'capabilities' => array(
-                        'create_posts' => 'customize',
-                        'delete_others_posts' => 'customize',
-                        'delete_post' => 'customize',
-                        'delete_posts' => 'customize',
-                        'delete_private_posts' => 'customize',
-                        'delete_published_posts' => 'customize',
-                        'edit_others_posts' => 'customize',
-                        'edit_post' => 'customize',
-                        'edit_posts' => 'customize',
-                        'edit_private_posts' => 'customize',
-                        'edit_published_posts' => 'do_not_allow',
-                        'publish_posts' => 'customize',
-                        'read' => 'read',
-                        'read_post' => 'customize',
-                        'read_private_posts' => 'customize',
-                ),
         ) );
 
         register_post_status( 'publish', array(