Ticket #42404: 42404.2.patch

src/wp-admin/includes/file.php

@@ -373 +373 @@
         if ( ! empty( $args['plugin'] ) ) {
                 $plugin = $args['plugin'];
 
-                if ( ! current_user_can( 'edit_plugins' ) ) {
-                        return new WP_Error( 'unauthorized', __( 'Sorry, you are not allowed to edit plugins for this site.' ) );
+                if ( ! current_user_can( 'edit_plugin', $plugin ) ) {
+                        return new WP_Error( 'unauthorized', __( 'Sorry, you are not allowed to edit this plugin.' ) );
                 }
 
                 if ( ! wp_verify_nonce( $args['nonce'], 'edit-plugin_' . $file ) ) {

src/wp-admin/plugin-editor.php

@@ -14 +14 @@
         exit();
 }
 
-if ( ! current_user_can( 'edit_plugins' ) ) {
-        wp_die( __( 'Sorry, you are not allowed to edit plugins for this site.' ) );
+$file = ( isset( $_REQUEST['file'] ) ) ?  wp_unslash( $_REQUEST['file'] ) : '';
+$plugin = isset( $_REQUEST['plugin'] ) ? wp_unslash( sanitize_text_field( $_REQUEST['plugin'] ) ) : '';
+
+if ( ! current_user_can( 'edit_plugin', $plugin) ) {
+    if( empty( $plugin ) )
+            wp_die( __( 'Sorry, you are not allowed to edit plugins for this site.' ) );
+    else
+            wp_die( __( 'Sorry, you are not allowed to edit this plugin.' ) );
 }
 
 $title       = __( 'Edit Plugins' );
@@ -35 +41 @@
         exit;
 }
 
-$file   = '';
-$plugin = '';
-if ( isset( $_REQUEST['file'] ) ) {
-        $file = wp_unslash( $_REQUEST['file'] );
-}
-
-if ( isset( $_REQUEST['plugin'] ) ) {
-        $plugin = wp_unslash( $_REQUEST['plugin'] );
-}
-
 if ( empty( $plugin ) ) {
         if ( $file ) {
 
@@ -219 +215 @@
                 <select name="plugin" id="plugin">
 <?php
 foreach ( $plugins as $plugin_key => $a_plugin ) {
+
+    if( ! current_user_can( 'edit_plugin', $plugin_key) )
+        continue;
+
         $plugin_name = $a_plugin['Name'];
         if ( $plugin_key == $plugin ) {
                 $selected = " selected='selected'";

src/wp-includes/capabilities.php

@@ -402 +402 @@
                         break;
                 case 'edit_files':
                 case 'edit_plugins':
+                case 'edit_plugin':
                 case 'edit_themes':
                         // Disallow the file editors.
                         if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT ) {
@@ -411 +412 @@
                         } elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
                                 $caps[] = 'do_not_allow';
                         } else {
-                                $caps[] = $cap;
+                                $caps[] = ( $cap == 'edit_plugin' ) ? 'edit_plugins' : $cap;
                         }
                         break;
                 case 'update_plugins':