WordPress.org
Get WordPress

Make WordPress Core

Changeset 12927


Ignore:
Timestamp:
02/02/2010 05:37:03 PM (15 years ago)
Author:
ryan
Message:

Allow customizing capabilities for custom post types. Always check caps against those in the post type object instead of contructing them manually. see #9674

Location:
trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-admin/edit-form-advanced.php

    r12887 r12927  
    8686
    8787$post_type_object = get_post_type_object($post_type);
    88 $post_type_cap = $post_type_object->capability_type;
    8988
    9089// All meta boxes should be defined and added before the first do_meta_boxes() call (or potentially during the do_meta_boxes action).
    … …  
    129128    add_meta_box('commentsdiv', __('Comments'), 'post_comment_meta_box', $post_type, 'normal', 'core');
    130129
    131 if ( !( 'pending' == $post->post_status && !current_user_can( 'publish_posts' ) ) )
     130if ( !( 'pending' == $post->post_status && !current_user_can( $post_type_object->publish_cap ) ) )
    132131    add_meta_box('slugdiv', __('Slug'), 'post_slug_meta_box', $post_type, 'normal', 'core');
    133132
    … …  
    193192<?php
    194193$sample_permalink_html = get_sample_permalink_html($post->ID);
    195 if ( !( 'pending' == $post->post_status && !current_user_can( 'publish_' . $post_type_cap . 's' ) ) ) { ?>
     194if ( !( 'pending' == $post->post_status && !current_user_can( $post_type_object->publish_cap ) ) ) { ?>
    196195    <div id="edit-slug-box">
    197196<?php

  • trunk/wp-admin/edit.php

    r12819 r12927  
    2828
    2929$post_type_object = get_post_type_object($post_type);
    30 $post_type_cap = $post_type_object->capability_type;
    3130
    3231if ( 'post' != $post_type ) {
    … …  
    7372            $trashed = 0;
    7473            foreach( (array) $post_ids as $post_id ) {
    75                 if ( !current_user_can('delete_' . $post_type_cap, $post_id) )
     74                if ( !current_user_can($post_type_object->delete_cap, $post_id) )
    7675                    wp_die( __('You are not allowed to move this item to the trash.') );
    7776
    … …  
    8685            $untrashed = 0;
    8786            foreach( (array) $post_ids as $post_id ) {
    88                 if ( !current_user_can('delete_' . $post_type_cap, $post_id) )
     87                if ( !current_user_can($post_type_object->delete_cap, $post_id) )
    8988                    wp_die( __('You are not allowed to restore this item from the trash.') );
    9089
    … …  
    101100                $post_del = & get_post($post_id);
    102101
    103                 if ( !current_user_can('delete_' .  $post_type_cap, $post_id) )
     102                if ( !current_user_can($post_type_object->delete_cap, $post_id) )
    104103                    wp_die( __('You are not allowed to delete this item.') );
    105104
    … …  
    142141
    143142$user_posts = false;
    144 if ( !current_user_can('edit_others_' . $post_type_cap . 's') ) {
     143if ( !current_user_can($post_type_object->edit_others_cap) ) {
    145144    $user_posts_count = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(1) FROM $wpdb->posts WHERE post_type = '%s' AND post_status != 'trash' AND post_author = %d", $post_type, $current_user->ID) );
    146145    $user_posts = true;
    … …  
    342341<?php }
    343342
    344 if ( $is_trash && current_user_can('edit_others_' . $post_type_cap .'s') ) { ?>
     343if ( $is_trash && current_user_can($post_type_object->edit_others_cap) ) { ?>
    345344<input type="submit" name="delete_all" id="delete_all" value="<?php esc_attr_e('Empty Trash'); ?>" class="button-secondary apply" />
    346345<?php } ?>
    … …  
    389388</select>
    390389<input type="submit" value="<?php esc_attr_e('Apply'); ?>" name="doaction2" id="doaction2" class="button-secondary action" />
    391 <?php if ( $is_trash && current_user_can('edit_others_' . $post_type_cap . 's') ) { ?>
     390<?php if ( $is_trash && current_user_can($post_type_object->edit_others_cap) ) { ?>
    392391<input type="submit" name="delete_all2" id="delete_all2" value="<?php esc_attr_e('Empty Trash'); ?>" class="button-secondary apply" />
    393392<?php } ?>

  • trunk/wp-admin/includes/template.php

    r12859 r12927  
    11291129    $m = ( isset($mode) && 'excerpt' == $mode ) ? 'excerpt' : 'list';
    11301130    // @todo use capability_type
    1131     $can_publish = current_user_can("publish_{$screen->post_type}s");
     1131    $can_publish = current_user_can($post_type_object->publish_cap);
    11321132    $core_columns = array( 'cb' => true, 'date' => true, 'title' => true, 'categories' => true, 'tags' => true, 'comments' => true, 'author' => true );
    11331133
    … …  
    13361336            </label>
    13371337
    1338 <?php if ( 'post' == $screen->post_type && $can_publish && current_user_can( 'edit_others_posts' ) ) : ?>
     1338<?php if ( 'post' == $screen->post_type && $can_publish && current_user_can( $post_type_object->edit_others_cap ) ) : ?>
    13391339
    13401340<?php   if ( $bulk ) : ?>
    … …  
    13581358<?php   endif; // $bulk ?>
    13591359
    1360 <?php endif; // !$is_page && $can_publish && current_user_can( 'edit_others_posts' ) ?>
     1360<?php endif; // !$is_page && $can_publish && current_user_can( 'edit_others_cap' ) ?>
    13611361
    13621362        </div>
    … …  
    14051405 */
    14061406function get_inline_data($post) {
    1407 
    1408     if ( ! current_user_can('edit_' . $post->post_type, $post->ID) )
     1407    $post_type_object = get_post_type_object($post->post_type);
     1408    if ( ! current_user_can($post_type_object->edit_cap, $post->ID) )
    14091409        return;
    14101410
    … …  
    14271427    <div class="post_password">' . esc_html( $post->post_password ) . '</div>';
    14281428
     1429    if ( $post_type_object->hierarchical )
     1430        echo '<div class="post_parent">' . $post->post_parent . '</div>';
     1431
    14291432    if ( $post->post_type == 'page' )
    1430         echo '
    1431     <div class="post_parent">' . $post->post_parent . '</div>
    1432     <div class="page_template">' . esc_html( get_post_meta( $post->ID, '_wp_page_template', true ) ) . '</div>
    1433     <div class="menu_order">' . $post->menu_order . '</div>';
     1433        echo '<div class="page_template">' . esc_html( get_post_meta( $post->ID, '_wp_page_template', true ) ) . '</div>';
     1434
     1435    if ( $post_type_object->hierarchical )
     1436        echo '<div class="menu_order">' . $post->menu_order . '</div>';
     1437
     1438    if ( is_object_in_taxonomy($post->post_type, 'post_tag') )
     1439        echo '<div class="tags_input">' . esc_html( str_replace( ',', ', ', get_tags_to_edit($post->ID) ) ) . '</div>';
     1440
     1441    if ( is_object_in_taxonomy($post->post_type, 'post_tag') )
     1442        echo '<div class="post_category">' . implode( ',', wp_get_post_categories( $post->ID ) ) . '</div>';
    14341443
    14351444    if ( $post->post_type == 'post' )
    1436         echo '
    1437     <div class="tags_input">' . esc_html( str_replace( ',', ', ', get_tags_to_edit($post->ID) ) ) . '</div>
    1438     <div class="post_category">' . implode( ',', wp_get_post_categories( $post->ID ) ) . '</div>
    1439     <div class="sticky">' . (is_sticky($post->ID) ? 'sticky' : '') . '</div>';
     1445        echo '<div class="sticky">' . (is_sticky($post->ID) ? 'sticky' : '') . '</div>';
    14401446
    14411447    echo '</div>';
    … …  
    14961502    $edit_link = get_edit_post_link( $post->ID );
    14971503    $title = _draft_or_post_title();
     1504    $post_type_object = get_post_type_object($post->post_type);
    14981505?>
    14991506    <tr id='post-<?php echo $post->ID; ?>' class='<?php echo trim( $rowclass . ' author-' . $post_owner . ' status-' . $post->post_status ); ?> iedit' valign="top">
    … …  
    15141521        case 'cb':
    15151522        ?>
    1516         <th scope="row" class="check-column"><?php if ( current_user_can( 'edit_post', $post->ID ) ) { ?><input type="checkbox" name="post[]" value="<?php the_ID(); ?>" /><?php } ?></th>
     1523        <th scope="row" class="check-column"><?php if ( current_user_can( $post_type_object->edit_cap, $post->ID ) ) { ?><input type="checkbox" name="post[]" value="<?php the_ID(); ?>" /><?php } ?></th>
    15171524        <?php
    15181525        break;
    … …  
    15571564            $attributes = 'class="post-title column-title"' . $style;
    15581565        ?>
    1559         <td <?php echo $attributes ?>><strong><?php if ( current_user_can('edit_post', $post->ID) && $post->post_status != 'trash' ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $title ?></a><?php } else { echo $title; }; _post_states($post); ?></strong>
     1566        <td <?php echo $attributes ?>><strong><?php if ( current_user_can($post_type_object->edit_cap, $post->ID) && $post->post_status != 'trash' ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $title ?></a><?php } else { echo $title; }; _post_states($post); ?></strong>
    15601567        <?php
    15611568            if ( 'excerpt' == $mode )
    … …  
    15631570
    15641571            $actions = array();
    1565             if ( current_user_can('edit_post', $post->ID) && 'trash' != $post->post_status ) {
     1572            if ( current_user_can($post_type_object->edit_cap, $post->ID) && 'trash' != $post->post_status ) {
    15661573                $actions['edit'] = '<a href="' . get_edit_post_link($post->ID, true) . '" title="' . esc_attr(__('Edit this post')) . '">' . __('Edit') . '</a>';
    15671574                $actions['inline hide-if-no-js'] = '<a href="#" class="editinline" title="' . esc_attr(__('Edit this post inline')) . '">' . __('Quick&nbsp;Edit') . '</a>';
    15681575            }
    1569             if ( current_user_can('delete_post', $post->ID) ) {
     1576            if ( current_user_can($post_type_object->delete_cap, $post->ID) ) {
    15701577                if ( 'trash' == $post->post_status )
    15711578                    $actions['untrash'] = "<a title='" . esc_attr(__('Restore this post from the Trash')) . "' href='" . wp_nonce_url("post.php?action=untrash&amp;post=$post->ID", 'untrash-post_' . $post->ID) . "'>" . __('Restore') . "</a>";
    … …  
    15761583            }
    15771584            if ( in_array($post->post_status, array('pending', 'draft')) ) {
    1578                 if ( current_user_can('edit_post', $post->ID) )
     1585                if ( current_user_can($post_type_object->edit_cap, $post->ID) )
    15791586                    $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
    15801587            } elseif ( 'trash' != $post->post_status ) {
    … …  
    16591666        case 'control_edit':
    16601667        ?>
    1661         <td><?php if ( current_user_can('edit_post', $post->ID) ) { echo "<a href='$edit_link' class='edit'>" . __('Edit') . "</a>"; } ?></td>
     1668        <td><?php if ( current_user_can($post_type_object->edit_cap, $post->ID) ) { echo "<a href='$edit_link' class='edit'>" . __('Edit') . "</a>"; } ?></td>
    16621669        <?php
    16631670        break;
    … …  
    16651672        case 'control_delete':
    16661673        ?>
    1667         <td><?php if ( current_user_can('delete_post', $post->ID) ) { echo "<a href='" . wp_nonce_url("post.php?action=delete&amp;post=$id", 'delete-post_' . $post->ID) . "' class='delete'>" . __('Delete') . "</a>"; } ?></td>
     1674        <td><?php if ( current_user_can($post_type_object->delete_cap, $post->ID) ) { echo "<a href='" . wp_nonce_url("post.php?action=delete&amp;post=$id", 'delete-post_' . $post->ID) . "' class='delete'>" . __('Delete') . "</a>"; } ?></td>
    16681675        <?php
    16691676        break;
    … …  
    17261733    $title = _draft_or_post_title();
    17271734    $post_type = $page->post_type;
     1735    $post_type_object = get_post_type_object($post_type);
    17281736?>
    17291737<tr id="page-<?php echo $id; ?>" class="<?php echo $rowclass; ?> iedit">
    17301738<?php
    17311739
    1732 foreach ($posts_columns as $column_name=>$column_display_name) {
     1740foreach ( $posts_columns as $column_name => $column_display_name ) {
    17331741    $class = "class=\"$column_name column-$column_name\"";
    17341742
    … …  
    17811789        $edit_link = get_edit_post_link( $page->ID );
    17821790        ?>
    1783         <td <?php echo $attributes ?>><strong><?php if ( current_user_can('edit_page', $page->ID) && $post->post_status != 'trash' ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . esc_html($parent_name) : ''; ?></strong>
     1791        <td <?php echo $attributes ?>><strong><?php if ( current_user_can($post_type_object->edit_cap, $page->ID) && $post->post_status != 'trash' ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . esc_html($parent_name) : ''; ?></strong>
    17841792        <?php
    17851793        $actions = array();
    1786         if ( current_user_can('edit_page', $page->ID) && $post->post_status != 'trash' ) {
     1794        if ( current_user_can($post_type_object->edit_cap, $page->ID) && $post->post_status != 'trash' ) {
    17871795            $actions['edit'] = '<a href="' . $edit_link . '" title="' . esc_attr(__('Edit this page')) . '">' . __('Edit') . '</a>';
    17881796            $actions['inline'] = '<a href="#" class="editinline">' . __('Quick&nbsp;Edit') . '</a>';
    17891797        }
    1790         if ( current_user_can('delete_page', $page->ID) ) {
     1798        if ( current_user_can($post_type_object->delete_cap, $page->ID) ) {
    17911799            if ( $post->post_status == 'trash' )
    17921800                $actions['untrash'] = "<a title='" . esc_attr(__('Remove this page from the Trash')) . "' href='" . wp_nonce_url("post.php?post_type=$post_type&amp;action=untrash&amp;post=$page->ID", 'untrash-page_' . $page->ID) . "'>" . __('Restore') . "</a>";
    … …  
    17971805        }
    17981806        if ( in_array($post->post_status, array('pending', 'draft')) ) {
    1799             if ( current_user_can('edit_page', $page->ID) )
     1807            if ( current_user_can($post_type_object->edit_cap, $page->ID) )
    18001808                $actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
    18011809        } elseif ( $post->post_status != 'trash' ) {
    … …  
    22152223    $post = get_post($comment->comment_post_ID);
    22162224    $the_comment_status = wp_get_comment_status($comment->comment_ID);
    2217     $user_can = current_user_can('edit_post', $post->ID);
     2225    $post_type_object = get_post_type_object($post->post_type);
     2226    $user_can = current_user_can($post_type_object->edit_cap, $post->ID);
    22182227
    22192228    $author_url = get_comment_author_url();

  • trunk/wp-admin/post-new.php

    r12728 r12927  
    5050
    5151// Show post form.
    52 if ( current_user_can('edit_' . $post_type_object->capability_type . 's') ) {
     52if ( current_user_can($post_type_object->edit_type_cap) ) {
    5353    $post = get_default_post_to_edit( $post_type );
    5454    include('edit-form-advanced.php');

  • trunk/wp-admin/post.php

    r12820 r12927  
    2626$post = null;
    2727$post_type_object = null;
    28 $post_type_cap = null;
    2928$post_type = null;
    3029if ( $post_id ) {
    … …  
    3635            $current_screen->post_type = $post->post_type;
    3736            $current_screen->id = $current_screen->post_type;
    38             $post_type_cap = $post_type_object->capability_type;
    3937        }
    4038    }
    … …  
    4543        $current_screen->post_type = $post_type;
    4644        $current_screen->id = $current_screen->post_type;
    47         $post_type_cap = $post_type_object->capability_type;
    4845    }
    4946}
    … …  
    234231    $post = & get_post($post_id);
    235232
    236     if ( !current_user_can('delete_' . $post_type_cap, $post_id) )
     233    if ( !current_user_can($post_type_object->delete_cap, $post_id) )
    237234        wp_die( __('You are not allowed to move this item to the trash.') );
    238235
    … …  
    247244    check_admin_referer('untrash-' . $post_type . '_' . $post_id);
    248245
    249     if ( !current_user_can('delete_' . $post_type_cap, $post_id) )
     246    if ( !current_user_can($post_type_object->delete_cap, $post_id) )
    250247        wp_die( __('You are not allowed to move this item out of the trash.') );
    251248
    … …  
    260257    check_admin_referer('delete-' . $post_type . '_' . $post_id);
    261258
    262     if ( !current_user_can('delete_' . $post_type_cap, $post_id) )
     259    if ( !current_user_can($post_type_object->delete_cap, $post_id) )
    263260        wp_die( __('You are not allowed to delete this item.') );
    264261

  • trunk/wp-includes/post.php

    r12923 r12927  
    701701 * inherit_type - The post type from which to inherit the edit link and capability type. Defaults to none.
    702702 * capability_type - The post type to use for checking read, edit, and delete capabilities. Defaults to "post".
     703 * edit_cap - The capability that controls editing a particular object of this post type. Defaults to "edit_$capability_type" (edit_post).
     704 * edit_type_cap - The capability that controls editing objects of this post type as a class. Defaults to "edit_ . $capability_type . s" (edit_posts).
     705 * edit_others_cap - The capability that controls editing objects of this post type that are owned by other users. Defaults to "edit_others_ . $capability_type . s" (edit_others_posts).
     706 * edit_others_cap - The capability that controls publishing objects of this post type. Defaults to "publish_ . $capability_type . s" (publish_posts).
     707 * read_cap - The capability that controls reading a particular object of this post type. Defaults to "read_$capability_type" (read_post).
     708 * delete_cap - The capability that controls deleting a particular object of this post type. Defaults to "delete_$capability_type" (delete_post).
    703709 * hierarchical - Whether the post type is hierarchical. Defaults to false.
    704710 * supports - An alias for calling add_post_type_support() directly. See add_post_type_support() for Documentation. Defaults to none.
    … …  
    737743        $args->label = $post_type;
    738744
    739     if ( empty($args->capability_type) ) {
    740         $args->edit_cap = '';
    741         $args->read_cap = '';
    742         $args->delete_cap = '';
    743     } else {
     745    if ( empty($args->capability_type) )
     746        $args->capability_type = 'post';
     747    if ( empty($args->edit_cap) )
    744748        $args->edit_cap = 'edit_' . $args->capability_type;
     749    if ( empty($args->edit_type_cap) )
     750        $args->edit_type_cap = 'edit_' . $args->capability_type . 's';
     751    if ( empty($args->edit_others_cap) )
     752        $args->edit_others_cap = 'edit_others_' . $args->capability_type . 's';
     753    if ( empty($args->publish_cap) )
     754        $args->publish_cap = 'publish_' . $args->capability_type . 's';
     755    if ( empty($args->read_cap) )
    745756        $args->read_cap = 'read_' . $args->capability_type;
     757    if ( empty($args->delete_cap) )
    746758        $args->delete_cap = 'delete_' . $args->capability_type;
    747     }
    748759
    749760    if ( !$args->_builtin && $args->public )
Note: See TracChangeset for help on using the changeset viewer.