Changeset 21745

Timestamp:

09/04/12 20:58:32 (20 months ago)

Author:

nacin

Message:

Improve API usage in wp-app.php for post operations and attachment deletion. Proper cap checks. Unregister put_file and delete_file as core itself doesn't provide for file replacement. for 3.4.

File:

• branches/3.4/wp-includes/class-wp-atom-server.php (modified) (11 diffs)

branches/3.4/wp-includes/class-wp-atom-server.php

@@ -168 +168 @@
                         'POST' => 'create_attachment'),
             '@/attachment/file/(\d+)$@' =>
-                array('GET' => 'get_file',
-                        'PUT' => 'put_file',
-                        'DELETE' => 'delete_file'),
+                array('GET' => 'get_file'),
             '@/attachment/(\d+)$@' =>
                 array('GET' => 'get_attachment',
@@ -316 +314 @@
         $entry = array_pop($parser->feed->entries);
 
+        $publish = ! ( isset( $entry->draft ) && 'yes' == trim( $entry->draft ) );
+        $cap = ($publish) ? 'publish_posts' : 'edit_posts';
+
+        if ( !current_user_can($cap) )
+            $this->auth_required(__('Sorry, you do not have the right to edit/publish new posts.'));
+
         $catnames = array();
         if ( !empty( $entry->categories ) ) {
@@ -331 +335 @@
                 array_push($post_category, $cat->term_id);
         }
-
-        $publish = ! ( isset( $entry->draft ) && 'yes' == trim( $entry->draft ) );
-
-        $cap = ($publish) ? 'publish_posts' : 'edit_posts';
-
-        if ( !current_user_can($cap) )
-            $this->auth_required(__('Sorry, you do not have the right to edit/publish new posts.'));
 
         $blog_ID = get_current_blog_id();
@@ -399 +396 @@
         global $entry;
 
-        if ( !current_user_can( 'edit_post', $postID ) )
+        if ( ! get_post( $postID ) || ! current_user_can( 'edit_post', $postID ) )
             $this->auth_required( __( 'Sorry, you do not have the right to access this post.' ) );
 
@@ -430 +427 @@
         $this->set_current_entry($postID);
 
-        if ( !current_user_can('edit_post', $entry['ID']) )
+        if ( !current_user_can('edit_post', $postID) )
             $this->auth_required(__('Sorry, you do not have the right to edit this post.'));
 
         $publish = ! ( isset($parsed->draft) && 'yes' == trim($parsed->draft) );
+
+        if ( $publish && ! current_user_can( 'publish_posts' ) )
+            $this->auth_required( __( 'Sorry, you do not have the right to publish this post.' ) );
+
         $post_status = ($publish) ? 'publish' : 'draft';
 
@@ -474 +475 @@
         $this->set_current_entry($postID);
 
-        if ( !current_user_can('edit_post', $postID) )
+        if ( !current_user_can('delete_post', $postID) )
             $this->auth_required(__('Sorry, you do not have the right to delete this post.'));
 
@@ -505 +506 @@
             $this->get_attachments();
         } else {
+            if ( ! current_user_can( 'edit_post', $postID ) )
+                $this->auth_required( __( 'Sorry, you do not have the right to edit this post.' ) );
+
             $this->set_current_entry($postID);
             $output = $this->get_entry($postID, 'attachment');
@@ -590 +594 @@
         $this->set_current_entry($postID);
 
-        if ( !current_user_can('edit_post', $entry['ID']) )
+        if ( !current_user_can('edit_post', $entry['ID']) || 'attachment' != $entry['post_type'] )
             $this->auth_required(__('Sorry, you do not have the right to edit this post.'));
 
@@ -625 +629 @@
         $this->set_current_entry($postID);
 
-        if ( !current_user_can('edit_post', $postID) )
+        if ( !current_user_can('delete_post', $postID) )
             $this->auth_required(__('Sorry, you do not have the right to delete this post.'));
 
@@ -634 +638 @@
             $this->internal_error(__('Error occurred while accessing post metadata for file location.'));
 
-        // delete file
-        @unlink($location);
-
         // delete attachment
-        $result = wp_delete_post($postID);
+        $result = wp_delete_attachment($postID);
 
         if ( !$result )
@@ -971 +972 @@
         $count = get_option('posts_per_rss');
 
-        wp('posts_per_page=' . $count . '&offset=' . ($count * ($page-1)) . '&orderby=modified&post_status=any');
+        wp('posts_per_page=' . $count . '&offset=' . ($count * ($page-1)) . '&orderby=modified&perm=readable');
 
         $post = $GLOBALS['post'];