Ticket #44238: 44238.4.diff

src/wp-admin/includes/ajax-actions.php

@@ -776 +776 @@
                 wp_die( 1 );
         }
 
-        if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta', $meta->post_id, $meta->meta_key ) ) {
+
+        $object_subtype = get_object_subtype( 'post', $id );
+        if ( is_protected_meta( $meta->meta_key, 'post', $object_subtype ) || ! current_user_can( 'delete_post_meta', $meta->post_id, $meta->meta_key ) ) {
                 wp_die( -1 );
         }
         if ( delete_meta( $meta->meta_id ) ) {
@@ -1512 +1514 @@
                 if ( ! $meta = get_metadata_by_mid( 'post', $mid ) ) {
                         wp_die( 0 ); // if meta doesn't exist
                 }
-                if ( is_protected_meta( $meta->meta_key, 'post' ) || is_protected_meta( $key, 'post' ) ||
+
+                $object_subtype = get_object_subtype( 'post', $meta->post_id );
+                if ( is_protected_meta( $meta->meta_key, 'post', $object_subtype ) || is_protected_meta( $key, 'post', $object_subtype ) ||
                         ! current_user_can( 'edit_post_meta', $meta->post_id, $meta->meta_key ) ||
                         ! current_user_can( 'edit_post_meta', $meta->post_id, $key ) ) {
                         wp_die( -1 );

src/wp-admin/includes/meta-boxes.php

@@ -725 +725 @@
 <div id="ajax-response"></div>
         <?php
         $metadata = has_meta( $post->ID );
+        $object_subtype = get_object_subtype( 'post', $post->ID );
         foreach ( $metadata as $key => $value ) {
-                if ( is_protected_meta( $metadata[ $key ]['meta_key'], 'post' ) || ! current_user_can( 'edit_post_meta', $post->ID, $metadata[ $key ]['meta_key'] ) ) {
+                if ( is_protected_meta( $metadata[ $key ]['meta_key'], 'post', $object_subtype ) || ! current_user_can( 'edit_post_meta', $post->ID, $metadata[ $key ]['meta_key'] ) ) {
                         unset( $metadata[ $key ] );
                 }
         }

src/wp-admin/includes/post.php

@@ -345 +345 @@
                         if ( $meta->post_id != $post_ID ) {
                                 continue;
                         }
-                        if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $meta->meta_key ) ) {
+                        $object_subtype = get_object_subtype( 'post', $post_ID );
+                        if ( is_protected_meta( $meta->meta_key, 'post', $object_subtype ) || ! current_user_can( 'edit_post_meta', $post_ID, $meta->meta_key ) ) {
                                 continue;
                         }
-                        if ( is_protected_meta( $value['key'], 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $value['key'] ) ) {
+                        if ( is_protected_meta( $value['key'], 'post', $object_subtype ) || ! current_user_can( 'edit_post_meta', $post_ID, $value['key'] ) ) {
                                 continue;
                         }
                         update_meta( $key, $value['key'], $value['value'] );
@@ -363 +364 @@
                         if ( $meta->post_id != $post_ID ) {
                                 continue;
                         }
-                        if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta', $post_ID, $meta->meta_key ) ) {
+                        $object_subtype = get_object_subtype( 'post', $post_ID );
+                        if ( is_protected_meta( $meta->meta_key, 'post', $object_subtype ) || ! current_user_can( 'delete_post_meta', $post_ID, $meta->meta_key ) ) {
                                 continue;
                         }
                         delete_meta( $key );
@@ -902 +904 @@
                 if ( $metakeyinput ) {
                         $metakey = $metakeyinput; // default
                 }
-
-                if ( is_protected_meta( $metakey, 'post' ) || ! current_user_can( 'add_post_meta', $post_ID, $metakey ) ) {
+                $object_subtype = get_object_subtype( 'post', $post_ID );
+                if ( is_protected_meta( $metakey, 'post', $object_subtype ) || ! current_user_can( 'add_post_meta', $post_ID, $metakey ) ) {
                         return false;
                 }
 

src/wp-admin/includes/template.php

@@ -590 +590 @@
 function _list_meta_row( $entry, &$count ) {
         static $update_nonce = '';
 
-        if ( is_protected_meta( $entry['meta_key'], 'post' ) ) {
+        $object_subtype = get_object_subtype( 'post', $entry['post_id'] );
+        if ( is_protected_meta( $entry['meta_key'], 'post', $object_subtype ) ) {
                 return '';
         }
 
@@ -701 +702 @@
 <select id="metakeyselect" name="metakeyselect">
 <option value="#NONE#"><?php _e( '&mdash; Select &mdash;' ); ?></option>
                 <?php
-
+                $object_subtype = get_object_subtype( 'post',  $post->ID );
                 foreach ( $keys as $key ) {
-                        if ( is_protected_meta( $key, 'post' ) || ! current_user_can( 'add_post_meta', $post->ID, $key ) ) {
+                        if ( is_protected_meta( $key, 'post', $object_subtype ) || ! current_user_can( 'add_post_meta', $post->ID, $key ) ) {
                                 continue;
                         }
                         echo "\n<option value='" . esc_attr( $key ) . "'>" . esc_html( $key ) . '</option>';

src/wp-includes/capabilities.php

@@ -293 +293 @@
                         $meta_key = isset( $args[1] ) ? $args[1] : false;
 
                         if ( $meta_key ) {
-                                $allowed = ! is_protected_meta( $meta_key, $object_type );
+                                $allowed = ! is_protected_meta( $meta_key, $object_type, $object_subtype );
 
                                 if ( ! empty( $object_subtype ) && has_filter( "auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype}" ) ) {
 

src/wp-includes/meta.php

@@ -1023 +1023 @@
  * Determines whether a meta key is considered protected.
  *
  * @since 3.1.3
+ * @since x.x.x  Add $object_sub_type
  *
  * @param string      $meta_key  Meta key.
  * @param string|null $meta_type Optional. Type of object metadata is for (e.g., comment, post, term, or user).
+ * @param string      $object_subtype Optional. Object sub type is for (e.g., post or page).
  * @return bool Whether the meta key is considered protected.
  */
-function is_protected_meta( $meta_key, $meta_type = null ) {
+function is_protected_meta( $meta_key, $meta_type = null, $object_subtype = '' ) {
         $protected = ( '_' == $meta_key[0] );
 
+
+        if ( ! empty( $meta_type ) ) {
+                /**
+                 * Filters whether a meta key is considered protected.
+                 *
+                 * @since x.x.x
+                 *
+                 * @param bool $protected Whether the key is considered protected.
+                 * @param string $meta_key Meta key.
+                 * @param string|null $meta_type Type of object metadata is for (e.g., comment, post, or user).
+                 * @param string $object_subtype Optional. Object sub type is for (e.g., post or page).
+                 */
+                $protected = apply_filters( "protected_{$meta_type}_meta_{$meta_key}", $protected, $meta_key, $meta_type, $object_subtype );
+                if ( ! empty( $object_subtype ) ) {
+                        /**
+                         * Filters whether a meta key is considered protected.
+                         *
+                         * @since x.x.x
+                         *
+                         * @param bool $protected Whether the key is considered protected.
+                         * @param string $meta_key Meta key.
+                         * @param string|null $meta_type Type of object metadata is for (e.g., comment, post, or user).
+                         * @param string $object_subtype Optional. Object sub type is for (e.g., post or page).
+                         */
+                        $protected = apply_filters( "protected_{$meta_type}_meta_{$meta_key}_for_{$object_subtype}", $protected, $meta_key, $meta_type, $object_subtype );
+                }
+        }
+
         /**
          * Filters whether a meta key is considered protected.
          *
          * @since 3.2.0
+         * @since x.x.x  Add $object_sub_type
          *
          * @param bool        $protected Whether the key is considered protected.
          * @param string      $meta_key  Meta key.
+         * @param string      $object_subtype Optional. Object sub type is for (e.g., post or page).
          * @param string|null $meta_type Type of object metadata is for (e.g., comment, post, term, or user).
          */
-        return apply_filters( 'is_protected_meta', $protected, $meta_key, $meta_type );
+        return apply_filters( 'is_protected_meta', $protected, $meta_key, $meta_type, $object_subtype );
 }
 
 /**
@@ -1136 +1168 @@
                 $wp_meta_keys = array();
         }
 
+        $protected = ( '_' == $meta_key[0] );
+
         $defaults = array(
                 'object_subtype'    => '',
                 'type'              => 'string',
@@ -1144 +1178 @@
                 'sanitize_callback' => null,
                 'auth_callback'     => null,
                 'show_in_rest'      => false,
+                'protected'         => $protected,
         );
 
         // There used to be individual args for sanitize and auth callbacks
@@ -1180 +1215 @@
 
         $object_subtype = ! empty( $args['object_subtype'] ) ? $args['object_subtype'] : '';
 
+
+        if ( is_callable( $args['protected'] ) ) {
+                $protected_callback = $args['protected'];
+        } else {
+                $protected = (bool) $args['protected'];
+                if ( empty( $protected ) ) {
+                        $protected_callback = '__return_false';
+                } else {
+                        $protected_callback = '__return_true';
+                }
+        }
+        
+        if ( ! empty( $object_subtype ) ) {
+                add_filter( "protected_{$object_type}_meta_{$meta_key}_for_{$object_subtype}", $protected_callback, 9, 1 );
+        } else {
+                add_filter( "protected_{$object_type}_meta_{$meta_key}", $protected_callback, 9, 1 );
+        }
+
+
         // If `auth_callback` is not provided, fall back to `is_protected_meta()`.
         if ( empty( $args['auth_callback'] ) ) {
-                if ( is_protected_meta( $meta_key, $object_type ) ) {
+                if ( is_protected_meta( $meta_key, $object_type, $object_subtype ) ) {
                         $args['auth_callback'] = '__return_false';
                 } else {
                         $args['auth_callback'] = '__return_true';

src/wp-includes/post-template.php

@@ -1069 +1069 @@
 function the_meta() {
         if ( $keys = get_post_custom_keys() ) {
                 $li_html = '';
+                $post_id = get_the_ID();
+                $object_subtype = get_object_subtype( 'post', $post_id );
                 foreach ( (array) $keys as $key ) {
                         $keyt = trim( $key );
-                        if ( is_protected_meta( $keyt, 'post' ) ) {
+                        if ( is_protected_meta( $keyt, 'post', $object_subtype ) ) {
                                 continue;
                         }