Changeset 19867

Timestamp:

02/08/2012 03:40:26 PM (13 years ago)

Author:

ryan

Message:

Simplify cap checking. Props nprasath002. see #18429

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (5 diffs)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -622 +622 @@
             return new IXR_Error( 403, __( 'Invalid post type' ) );
 
-        if ( ! current_user_can( $post_type->cap->edit_posts ) )
-            return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
+        $update = false;
+        if ( ! empty( $post_data[ 'ID' ] ) ) 
+            $update = true; 
+
+        if ( $update ) {
+            if ( ! current_user_can( $post_type->cap->edit_post, $post_data[ 'ID' ] ) )
+                return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
+        } else {
+            if ( ! current_user_can( $post_type->cap->edit_posts ) )
+                return new IXR_Error( 401, __( 'Sorry, you are not allowed to post on this site.' ) );
+        }
 
         switch ( $post_data['post_status'] ) {
@@ -646 +655 @@
             return new IXR_Error( 401, __( 'Sorry, you are not allowed to create password protected posts in this post type' ) );
 
-
         $post_data['post_author'] = absint( $post_data['post_author'] );
         if ( ! empty( $post_data['post_author'] ) && $post_data['post_author'] != $user->ID ) {
@@ -656 +664 @@
             if ( ! $author )
                 return new IXR_Error( 404, __( 'Invalid author ID.' ) );
-        }
-        else {
+        } else {
             $post_data['post_author'] = $user->ID;
         }
@@ -3136 +3143 @@
         $publish     = $args[4];
 
-        if ( !$user = $this->login($username, $password) )
+        if ( ! $user = $this->login($username, $password) )
             return $this->error;
 
         do_action('xmlrpc_call', 'metaWeblog.editPost');
 
-        $cap = ( $publish ) ? 'publish_posts' : 'edit_posts';
-        $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
-        $post_type = 'post';
-        $page_template = '';
-        if ( !empty( $content_struct['post_type'] ) ) {
-            if ( $content_struct['post_type'] == 'page' ) {
-                if ( $publish || 'publish' == $content_struct['page_status'] )
-                    $cap  = 'publish_pages';
-                else
-                    $cap = 'edit_pages';
-                $error_message = __( 'Sorry, you are not allowed to publish pages on this site.' );
-                $post_type = 'page';
-                if ( !empty( $content_struct['wp_page_template'] ) )
-                    $page_template = $content_struct['wp_page_template'];
-            } elseif ( $content_struct['post_type'] == 'post' ) {
-                if ( $publish || 'publish' == $content_struct['post_status'] )
-                    $cap  = 'publish_posts';
-                else
-                    $cap = 'edit_posts';
-                $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
-                $post_type = 'post';
-            } else {
-                // No other post_type values are allowed here
-                return new IXR_Error( 401, __( 'Invalid post type.' ) );
-            }
-        } else {
-            if ( $publish || 'publish' == $content_struct['post_status'] )
-                $cap  = 'publish_posts';
-            else
-                $cap = 'edit_posts';
-            $error_message = __( 'Sorry, you are not allowed to publish posts on this site.' );
-            $post_type = 'post';
-        }
-
-        if ( !current_user_can( $cap ) )
-            return new IXR_Error( 401, $error_message );
+        $postdata = wp_get_single_post( $post_ID, ARRAY_A );
+
+        // If there is no post data for the give post id, stop
+        // now and return an error. Other wise a new post will be
+        // created (which was the old behavior).
+        if ( ! $postdata || empty( $postdata[ 'ID' ] ) )
+            return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+
+        if ( ! current_user_can( 'edit_post', $post_ID ) )
+            return new IXR_Error( 401, __( 'Sorry, you do not have the right to edit this post.' ) );
 
         // Check for a valid post format if one was given
@@ -3185 +3166 @@
             }
         }
-
-        $postdata = wp_get_single_post($post_ID, ARRAY_A);
-
-        // If there is no post data for the give post id, stop
-        // now and return an error. Other wise a new post will be
-        // created (which was the old behavior).
-        if ( empty($postdata["ID"]) )
-            return(new IXR_Error(404, __('Invalid post ID.')));
 
         $this->escape($postdata);