Changeset 23032 for trunk/wp-includes/media.php

Timestamp:

12/04/2012 06:33:51 PM (14 years ago)

Author:

ryan

Message:

Only show Delete in media modal if the user can delete.

Props nacin, koopersmith
fixes #22711

File:

• trunk/wp-includes/media.php (modified) (2 diffs)

trunk/wp-includes/media.php

@@ -1335 +1335 @@
                 'dateFormatted' => mysql2date( get_option('date_format'), $attachment->post_date ),
                 'nonces'      => array(
-                        'update' => wp_create_nonce( 'update-post_' . $attachment->ID ),
-                        'delete' => wp_create_nonce( 'delete-post_' . $attachment->ID ),
+                        'update' => false,
+                        'delete' => false,
                 ),
         );
+
+        if ( current_user_can( 'edit_post', $attachment->ID ) )
+                $response['nonces']['update'] = wp_create_nonce( 'update-post_' . $attachment->ID );
+
+        if ( current_user_can( 'delete_post', $attachment->ID ) )
+                $response['nonces']['delete'] = wp_create_nonce( 'delete-post_' . $attachment->ID );
 
         if ( $meta && 'image' === $type ) {
@@ -1691 +1697 @@
                                         <div class="dimensions">{{ data.width }} &times; {{ data.height }}</div>
                                 <# } #>
-                                <# if ( ! data.uploading ) { #>
+                                <# if ( ! data.uploading && data.can.remove ) { #>
                                         <div class="delete-attachment">
                                                 <a href="#"><?php _e( 'Delete Permanently' ); ?></a>