Changeset 22769

Timestamp:

11/21/2012 04:34:57 PM (11 years ago)

Author:

westi

Message:

Posting: Improve the capability checking _wp_translate_postdata() when updating posts.

• Use the specific post_type's 'edit_post' cap
• Pass the ID of the post being edited.

Fixes #22417

File:

• trunk/wp-admin/includes/post.php (modified) (1 diff)

trunk/wp-admin/includes/post.php

@@ -54 +54 @@
     $ptype = get_post_type_object( $post_data['post_type'] );
     if ( isset($post_data['user_ID']) && ($post_data['post_author'] != $post_data['user_ID']) ) {
-        if ( !current_user_can( $ptype->cap->edit_others_posts ) ) {
-            if ( 'page' == $post_data['post_type'] ) {
-                return new WP_Error( 'edit_others_pages', $update ?
-                    __( 'You are not allowed to edit pages as this user.' ) :
-                    __( 'You are not allowed to create pages as this user.' )
-                );
-            } else {
-                return new WP_Error( 'edit_others_posts', $update ?
-                    __( 'You are not allowed to edit posts as this user.' ) :
-                    __( 'You are not allowed to create posts as this user.' )
-                );
+        if ( $update ) {
+            if ( ! current_user_can( $ptype->cap->edit_post, $post_data['ID'] ) ) {
+                if ( 'page' == $post_data['post_type'] ) {
+                    return new WP_Error( 'edit_others_pages', __( 'You are not allowed to edit pages as this user.' ) );
+                } else {
+                    return new WP_Error( 'edit_others_posts', __( 'You are not allowed to edit posts as this user.' ) );
+                }
+            }
+        } else {
+            if ( ! current_user_can( $ptype->cap->edit_others_posts )  ) {
+                if ( 'page' == $post_data['post_type'] ) {
+                    return new WP_Error( 'edit_others_pages', __( 'You are not allowed to create pages as this user.' ) );
+                } else {
+                    return new WP_Error( 'edit_others_posts', __( 'You are not allowed to create posts as this user.' ) );
+                }
             }
         }