WordPress.org
Get WordPress

Make WordPress Core


Ignore:
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-includes/capabilities.php

    r16631 r16910  
    472472     * @param int|string $id User's ID or username
    473473     * @param int $name Optional. User's username
     474     * @param int $blog_id Optional Blog ID, defaults to current blog.
    474475     * @return WP_User
    475476     */
    476     function WP_User( $id, $name = '' ) {
     477    function WP_User( $id, $name = '', $blog_id = '' ) {
    477478
    478479        if ( empty( $id ) && empty( $name ) )
    … …  
    497498
    498499        $this->id = $this->ID;
    499         $this->_init_caps();
     500        $this->for_blog( $blog_id );
    500501    }
    501502
    … …  
    605606        foreach ( (array) $this->roles as $oldrole )
    606607            unset( $this->caps[$oldrole] );
     608
     609        if ( 1 == count( $this->roles ) && $role == $this->roles[0] )
     610            return;
     611
    607612        if ( !empty( $role ) ) {
    608613            $this->caps[$role] = true;
    … …  
    737742        // Must have ALL requested caps
    738743        $capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args );
     744        $capabilities['exist'] = true; // Everyone is allowed to exist
    739745        foreach ( (array) $caps as $cap ) {
    740746            //echo "Checking cap $cap<br />";
    … …  
    816822        break;
    817823    case 'delete_post':
     824    case 'delete_page':
    818825        $author_data = get_userdata( $user_id );
    819         //echo "post ID: {$args[0]}<br />";
    820826        $post = get_post( $args[0] );
    821827        $post_type = get_post_type_object( $post->post_type );
    822         if ( $post_type && 'post' != $post_type->capability_type ) {
    823             $args = array_merge( array( $post_type->cap->delete_post, $user_id ), $args );
    824             return call_user_func_array( 'map_meta_cap', $args );
     828
     829        if ( ! $post_type->map_meta_cap ) {
     830            $caps[] = $post_type->cap->$cap;
     831            // Prior to 3.1 we would re-call map_meta_cap here.
     832            if ( 'delete_post' == $cap )
     833                $cap = $post_type->cap->$cap;
     834            break;
    825835        }
    826836
    … …  
    828838            $post_author_data = get_userdata( $post->post_author );
    829839        } else {
    830             //No author set yet so default to current user for cap checks
     840            // No author set yet, so default to current user for cap checks.
    831841            $post_author_data = $author_data;
    832842        }
    … …  
    836846            // If the post is published...
    837847            if ( 'publish' == $post->post_status ) {
    838                 $caps[] = 'delete_published_posts';
     848                $caps[] = $post_type->cap->delete_published_posts;
    839849            } elseif ( 'trash' == $post->post_status ) {
    840850                if ('publish' == get_post_meta($post->ID, '_wp_trash_meta_status', true) )
    841                     $caps[] = 'delete_published_posts';
     851                    $caps[] = $post_type->cap->delete_published_posts;
    842852            } else {
    843853                // If the post is draft...
    844                 $caps[] = 'delete_posts';
     854                $caps[] = $post_type->cap->delete_posts;
    845855            }
    846856        } else {
    847857            // The user is trying to edit someone else's post.
    848             $caps[] = 'delete_others_posts';
     858            $caps[] = $post_type->cap->delete_others_posts;
    849859            // The post is published, extra cap required.
    850860            if ( 'publish' == $post->post_status )
    851                 $caps[] = 'delete_published_posts';
     861                $caps[] = $post_type->cap->delete_published_posts;
    852862            elseif ( 'private' == $post->post_status )
    853                 $caps[] = 'delete_private_posts';
    854         }
    855         break;
    856     case 'delete_page':
    857         $author_data = get_userdata( $user_id );
    858         //echo "post ID: {$args[0]}<br />";
    859         $page = get_page( $args[0] );
    860         $page_author_data = get_userdata( $page->post_author );
    861         //echo "current user id : $user_id, page author id: " . $page_author_data->ID . "<br />";
    862         // If the user is the author...
    863 
    864         if ('' != $page->post_author) {
    865             $page_author_data = get_userdata( $page->post_author );
    866         } else {
    867             //No author set yet so default to current user for cap checks
    868             $page_author_data = $author_data;
    869         }
    870 
    871         if ( is_object( $page_author_data ) && $user_id == $page_author_data->ID ) {
    872             // If the page is published...
    873             if ( $page->post_status == 'publish' ) {
    874                 $caps[] = 'delete_published_pages';
    875             } elseif ( 'trash' == $page->post_status ) {
    876                 if ('publish' == get_post_meta($page->ID, '_wp_trash_meta_status', true) )
    877                     $caps[] = 'delete_published_pages';
    878             } else {
    879                 // If the page is draft...
    880                 $caps[] = 'delete_pages';
    881             }
    882         } else {
    883             // The user is trying to edit someone else's page.
    884             $caps[] = 'delete_others_pages';
    885             // The page is published, extra cap required.
    886             if ( $page->post_status == 'publish' )
    887                 $caps[] = 'delete_published_pages';
    888             elseif ( $page->post_status == 'private' )
    889                 $caps[] = 'delete_private_pages';
     863                $caps[] = $post_type->cap->delete_private_posts;
    890864        }
    891865        break;
    … …  
    893867        // edit_others_posts
    894868    case 'edit_post':
     869    case 'edit_page':
    895870        $author_data = get_userdata( $user_id );
    896         //echo "post ID: {$args[0]}<br />";
    897871        $post = get_post( $args[0] );
    898872        $post_type = get_post_type_object( $post->post_type );
    899         if ( $post_type && 'post' != $post_type->capability_type ) {
    900             $args = array_merge( array( $post_type->cap->edit_post, $user_id ), $args );
    901             return call_user_func_array( 'map_meta_cap', $args );
    902         }
    903         $post_author_data = get_userdata( $post->post_author );
     873
     874        if ( ! $post_type->map_meta_cap ) {
     875            $caps[] = $post_type->cap->$cap;
     876            // Prior to 3.1 we would re-call map_meta_cap here.
     877            if ( 'edit_post' == $cap )
     878                $cap = $post_type->cap->$cap;
     879            break;
     880        }
     881
     882        if ( '' != $post->post_author ) {
     883            $post_author_data = get_userdata( $post->post_author );
     884        } else {
     885            // No author set yet, so default to current user for cap checks.
     886            $post_author_data = $author_data;
     887        }
     888
    904889        //echo "current user id : $user_id, post author id: " . $post_author_data->ID . "<br />";
    905890        // If the user is the author...
    … …  
    907892            // If the post is published...
    908893            if ( 'publish' == $post->post_status ) {
    909                 $caps[] = 'edit_published_posts';
     894                $caps[] = $post_type->cap->edit_published_posts;
    910895            } elseif ( 'trash' == $post->post_status ) {
    911896                if ('publish' == get_post_meta($post->ID, '_wp_trash_meta_status', true) )
    912                     $caps[] = 'edit_published_posts';
     897                    $caps[] = $post_type->cap->edit_published_posts;
    913898            } else {
    914899                // If the post is draft...
    915                 $caps[] = 'edit_posts';
     900                $caps[] = $post_type->cap->edit_posts;
    916901            }
    917902        } else {
    918903            // The user is trying to edit someone else's post.
    919             $caps[] = 'edit_others_posts';
     904            $caps[] = $post_type->cap->edit_others_posts;
    920905            // The post is published, extra cap required.
    921906            if ( 'publish' == $post->post_status )
    922                 $caps[] = 'edit_published_posts';
     907                $caps[] = $post_type->cap->edit_published_posts;
    923908            elseif ( 'private' == $post->post_status )
    924                 $caps[] = 'edit_private_posts';
    925         }
    926         break;
    927     case 'edit_page':
    928         $author_data = get_userdata( $user_id );
    929         //echo "post ID: {$args[0]}<br />";
    930         $page = get_page( $args[0] );
    931         $page_author_data = get_userdata( $page->post_author );
    932         //echo "current user id : $user_id, page author id: " . $page_author_data->ID . "<br />";
    933         // If the user is the author...
    934         if ( is_object( $page_author_data ) && $user_id == $page_author_data->ID ) {
    935             // If the page is published...
    936             if ( 'publish' == $page->post_status ) {
    937                 $caps[] = 'edit_published_pages';
    938             } elseif ( 'trash' == $page->post_status ) {
    939                 if ('publish' == get_post_meta($page->ID, '_wp_trash_meta_status', true) )
    940                     $caps[] = 'edit_published_pages';
    941             } else {
    942                 // If the page is draft...
    943                 $caps[] = 'edit_pages';
    944             }
    945         } else {
    946             // The user is trying to edit someone else's page.
    947             $caps[] = 'edit_others_pages';
    948             // The page is published, extra cap required.
    949             if ( 'publish' == $page->post_status )
    950                 $caps[] = 'edit_published_pages';
    951             elseif ( 'private' == $page->post_status )
    952                 $caps[] = 'edit_private_pages';
     909                $caps[] = $post_type->cap->edit_private_posts;
    953910        }
    954911        break;
    955912    case 'read_post':
     913    case 'read_page':
     914        $author_data = get_userdata( $user_id );
    956915        $post = get_post( $args[0] );
    957916        $post_type = get_post_type_object( $post->post_type );
    958         if ( $post_type && 'post' != $post_type->capability_type ) {
    959             $args = array_merge( array( $post_type->cap->read_post, $user_id ), $args );
    960             return call_user_func_array( 'map_meta_cap', $args );
     917
     918        if ( ! $post_type->map_meta_cap ) {
     919            $caps[] = $post_type->cap->$cap;
     920            // Prior to 3.1 we would re-call map_meta_cap here.
     921            if ( 'read_post' == $cap )
     922                $cap = $post_type->cap->$cap;
     923            break;
    961924        }
    962925
    963926        if ( 'private' != $post->post_status ) {
    964             $caps[] = 'read';
     927            $caps[] = $post_type->cap->read;
    965928            break;
    966929        }
    967930
    968         $author_data = get_userdata( $user_id );
    969         $post_author_data = get_userdata( $post->post_author );
     931        if ( '' != $post->post_author ) {
     932            $post_author_data = get_userdata( $post->post_author );
     933        } else {
     934            // No author set yet, so default to current user for cap checks.
     935            $post_author_data = $author_data;
     936        }
     937
    970938        if ( is_object( $post_author_data ) && $user_id == $post_author_data->ID )
    971             $caps[] = 'read';
     939            $caps[] = $post_type->cap->read;
    972940        else
    973             $caps[] = 'read_private_posts';
     941            $caps[] = $post_type->cap->read_private_posts;
    974942        break;
    975     case 'read_page':
    976         $page = get_page( $args[0] );
    977 
    978         if ( 'private' != $page->post_status ) {
    979             $caps[] = 'read';
    980             break;
    981         }
    982 
    983         $author_data = get_userdata( $user_id );
    984         $page_author_data = get_userdata( $page->post_author );
    985         if ( is_object( $page_author_data ) && $user_id == $page_author_data->ID )
    986             $caps[] = 'read';
    987         else
    988             $caps[] = 'read_private_pages';
     943    case 'edit_comment':
     944        $comment = get_comment( $args[0] );
     945        $post = get_post( $comment->comment_post_ID );
     946        $post_type_object = get_post_type_object( $post->post_type );
     947
     948        $caps = map_meta_cap( $post_type_object->cap->edit_post, $user_id, $post->ID );
    989949        break;
    990950    case 'unfiltered_upload':
    … …  
    1035995        break;
    1036996    case 'create_users':
    1037         if ( is_multisite() && !get_site_option( 'add_new_users' ) )
     997        if ( !is_multisite() )
     998            $caps[] = $cap;
     999        elseif ( is_super_admin() || get_site_option( 'add_new_users' ) )
     1000            $caps[] = $cap;
     1001        else
    10381002            $caps[] = 'do_not_allow';
    1039         else
    1040             $caps[] = $cap;
    10411003        break;
    10421004    default:
     1005        // Handle meta capabilities for custom post types.
     1006        $post_type_meta_caps = _post_type_meta_capabilities();
     1007        if ( isset( $post_type_meta_caps[ $cap ] ) ) {
     1008            $args = array_merge( array( $post_type_meta_caps[ $cap ], $user_id ), $args );
     1009            return call_user_func_array( 'map_meta_cap', $args );
     1010        }
     1011
    10431012        // If no meta caps match, return the original cap.
    10441013        $caps[] = $cap;
    … …  
    11201089
    11211090/**
     1091 * Whether a particular user has capability or role.
     1092 *
     1093 * @since 3.1.0
     1094 *
     1095 * @param int|object $user User ID or object.
     1096 * @param string $capability Capability or role name.
     1097 * @return bool
     1098 */
     1099function user_can( $user, $capability ) {
     1100    if ( ! is_object( $user ) )
     1101        $user = new WP_User( $user );
     1102
     1103    if ( ! $user || ! $user->ID )
     1104        return false;
     1105
     1106    $args = array_slice( func_get_args(), 2 );
     1107    $args = array_merge( array( $capability ), $args );
     1108
     1109    return call_user_func_array( array( &$user, 'has_cap' ), $args );
     1110}
     1111
     1112/**
    11221113 * Retrieve role object.
    11231114 *
    … …  
    11451136 * @param string $role Role name.
    11461137 * @param string $display_name Display name for role.
    1147  * @param array $capabilities List of capabilities.
     1138 * @param array $capabilities List of capabilities, e.g. array( 'edit_posts' => true, 'delete_posts' => false );
    11481139 * @return null|WP_Role WP_Role object if role is added, null if already exists.
    11491140 */
    … …  
    12021193 */
    12031194function is_super_admin( $user_id = false ) {
    1204     if ( ! $user_id ) {
    1205         $current_user = wp_get_current_user();
    1206         $user_id = ! empty($current_user) ? $current_user->id : 0;
    1207     }
    1208 
    1209     if ( ! $user_id )
     1195    if ( $user_id )
     1196        $user = new WP_User( $user_id );
     1197    else
     1198        $user = wp_get_current_user();
     1199
     1200    if ( empty( $user->id ) )
    12101201        return false;
    1211 
    1212     $user = new WP_User($user_id);
    12131202
    12141203    if ( is_multisite() ) {
Note: See TracChangeset for help on using the changeset viewer.