Changeset 13786

Timestamp:

03/21/2010 02:29:11 AM (16 years ago)

Author:

dd32

Message:

Use correct cap checks and nonces for custom post_type's

Location:

trunk

Files:

• wp-admin/includes/meta-boxes.php (modified) (3 diffs)
• wp-admin/includes/template.php (modified) (3 diffs)
• wp-includes/capabilities.php (modified) (3 diffs)

trunk/wp-admin/includes/meta-boxes.php

@@ -15 +15 @@
     $post_type = $post->post_type;
     $post_type_object = get_post_type_object($post_type);
-    $type_cap = $post_type_object->capability_type;
-    $can_publish = current_user_can("publish_${type_cap}s");
+    $can_publish = current_user_can($post_type_object->publish_cap);
 ?>
 <div class="submitbox" id="submitpost">
@@ -195 +194 @@
 <div id="delete-action">
 <?php
-if ( current_user_can( "delete_${type_cap}", $post->ID ) ) {
+if ( current_user_can( "delete_post", $post->ID ) ) {
     if ( !EMPTY_TRASH_DAYS ) {
         $delete_url = wp_nonce_url( add_query_arg( array('action' => 'delete', 'post' => $post->ID) ), "delete-${post_type}_{$post->ID}" );
@@ -408 +407 @@
 
 /** 
- * Displa comments for post table header
+ * Display comments for post table header
  * 
  * @since 3.0

trunk/wp-admin/includes/template.php

@@ -864 +864 @@
         $taxonomy = get_taxonomy( $taxonomy_name);
 
-        if( !$taxonomy->show_ui ) continue;
-
-        if( $taxonomy->hierarchical )
+        if ( !$taxonomy->show_ui )
+            continue;
+
+        if ( $taxonomy->hierarchical )
             $hierarchical_taxonomies[] = $taxonomy;
         else
@@ -876 +877 @@
     $col_count = count($columns) - count($hidden);
     $m = ( isset($mode) && 'excerpt' == $mode ) ? 'excerpt' : 'list';
-    // @todo use capability_type
     $can_publish = current_user_can($post_type_object->publish_cap);
     $core_columns = array( 'cb' => true, 'date' => true, 'title' => true, 'categories' => true, 'tags' => true, 'comments' => true, 'author' => true );
@@ -1562 +1562 @@
         if ( current_user_can($post_type_object->delete_cap, $page->ID) ) {
             if ( $post->post_status == 'trash' )
-                $actions['untrash'] = "<a title='" . esc_attr(__('Remove this page from the Trash')) . "' href='" . wp_nonce_url("post.php?post_type=$post_type&amp;action=untrash&amp;post=$page->ID", 'untrash-page_' . $page->ID) . "'>" . __('Restore') . "</a>";
+                $actions['untrash'] = "<a title='" . esc_attr(__('Remove this page from the Trash')) . "' href='" . wp_nonce_url("post.php?post_type=$post_type&amp;action=untrash&amp;post=$page->ID", 'untrash-' . $post->post_type . '_' . $page->ID) . "'>" . __('Restore') . "</a>";
             elseif ( EMPTY_TRASH_DAYS )
                 $actions['trash'] = "<a class='submitdelete' title='" . esc_attr(__('Move this page to the Trash')) . "' href='" . get_delete_post_link($page->ID) . "'>" . __('Trash') . "</a>";
             if ( $post->post_status == 'trash' || !EMPTY_TRASH_DAYS )
-                $actions['delete'] = "<a class='submitdelete' title='" . esc_attr(__('Delete this page permanently')) . "' href='" . wp_nonce_url("post.php?post_type=$post_type&amp;action=delete&amp;post=$page->ID", 'delete-page_' . $page->ID) . "'>" . __('Delete Permanently') . "</a>";
+                $actions['delete'] = "<a class='submitdelete' title='" . esc_attr(__('Delete this page permanently')) . "' href='" . wp_nonce_url("post.php?post_type=$post_type&amp;action=delete&amp;post=$page->ID", 'delete-' . $post->post_type . '_' . $page->ID) . "'>" . __('Delete Permanently') . "</a>";
         }
         if ( in_array($post->post_status, array('pending', 'draft')) ) {

trunk/wp-includes/capabilities.php

@@ -811 +811 @@
         $post_type = get_post_type_object( $post->post_type );
         if ( $post_type && 'post' != $post_type->capability_type ) {
-            $args = array_merge( array( 'delete_' . $post_type->capability_type, $user_id ), $args );
+            $args = array_merge( array( $post_type->delete_cap, $user_id ), $args );
             return call_user_func_array( 'map_meta_cap', $args );
         }
@@ -888 +888 @@
         $post_type = get_post_type_object( $post->post_type );
         if ( $post_type && 'post' != $post_type->capability_type ) {
-            $args = array_merge( array( 'edit_' . $post_type->capability_type, $user_id ), $args );
+            $args = array_merge( array( $post_type->edit_cap, $user_id ), $args );
             return call_user_func_array( 'map_meta_cap', $args );
         }
@@ -947 +947 @@
         $post_type = get_post_type_object( $post->post_type );
         if ( $post_type && 'post' != $post_type->capability_type ) {
-            $args = array_merge( array( 'read_' . $post_type->capability_type, $user_id ), $args );
+            $args = array_merge( array( $post_type->read_cap, $user_id ), $args );
             return call_user_func_array( 'map_meta_cap', $args );
         }