Changeset 20568

Timestamp:

04/23/2012 09:54:30 PM (12 years ago)

Author:

ryan

Message:

Check the publish_post cap when publishing an already existing post.

Props nprasath002
Fixes #20474

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -786 +786 @@
                 break;
             case 'private':
-                if ( ! current_user_can( $post_type->cap->publish_posts ) )
-                    return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type' ));
+                if ( $update ) {
+                    if ( ! current_user_can( $post_type->cap->publish_post, $post_data[ 'ID' ] ) )
+                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to set this post as private.' ) );
+                } else {
+                    if ( ! current_user_can( $post_type->cap->publish_posts ) )
+                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to create private posts in this post type' ));
+                }
                 break;
             case 'publish':
             case 'future':
-                if ( ! current_user_can( $post_type->cap->publish_posts ) )
-                    return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type' ));
+                if ( $update ) {
+                    if ( ! current_user_can( $post_type->cap->publish_post, $post_data[ 'ID' ] ) )
+                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish this post.' ) );
+                } else {
+                    if ( ! current_user_can( $post_type->cap->publish_posts ) )
+                        return new IXR_Error( 401, __( 'Sorry, you are not allowed to publish posts in this post type' ));
+                }
                 break;
             default: