Changeset 22769

Timestamp:

11/21/2012 04:34:57 PM (14 years ago)

Author:

westi

Message:

Posting: Improve the capability checking _wp_translate_postdata() when updating posts.

• Use the specific post_type's 'edit_post' cap
• Pass the ID of the post being edited.

Fixes #22417

File:

• trunk/wp-admin/includes/post.php (modified) (1 diff)

trunk/wp-admin/includes/post.php

@@ -54 +54 @@
         $ptype = get_post_type_object( $post_data['post_type'] );
         if ( isset($post_data['user_ID']) && ($post_data['post_author'] != $post_data['user_ID']) ) {
-                if ( !current_user_can( $ptype->cap->edit_others_posts ) ) {
-                        if ( 'page' == $post_data['post_type'] ) {
-                                return new WP_Error( 'edit_others_pages', $update ?
-                                        __( 'You are not allowed to edit pages as this user.' ) :
-                                        __( 'You are not allowed to create pages as this user.' )
-                                );
-                        } else {
-                                return new WP_Error( 'edit_others_posts', $update ?
-                                        __( 'You are not allowed to edit posts as this user.' ) :
-                                        __( 'You are not allowed to create posts as this user.' )
-                                );
+                if ( $update ) {
+                        if ( ! current_user_can( $ptype->cap->edit_post, $post_data['ID'] ) ) {
+                                if ( 'page' == $post_data['post_type'] ) {
+                                        return new WP_Error( 'edit_others_pages', __( 'You are not allowed to edit pages as this user.' ) );
+                                } else {
+                                        return new WP_Error( 'edit_others_posts', __( 'You are not allowed to edit posts as this user.' ) );
+                                }
+                        }
+                } else {
+                        if ( ! current_user_can( $ptype->cap->edit_others_posts )  ) {
+                                if ( 'page' == $post_data['post_type'] ) {
+                                        return new WP_Error( 'edit_others_pages', __( 'You are not allowed to create pages as this user.' ) );
+                                } else {
+                                        return new WP_Error( 'edit_others_posts', __( 'You are not allowed to create posts as this user.' ) );
+                                }
                         }
                 }