Changeset 23032 for trunk/wp-includes/media.php

Timestamp:

12/04/2012 06:33:51 PM (12 years ago)

Author:

ryan

Message:

Only show Delete in media modal if the user can delete.

Props nacin, koopersmith
fixes #22711

File:

• trunk/wp-includes/media.php (modified) (2 diffs)

trunk/wp-includes/media.php

@@ -1335 +1335 @@
         'dateFormatted' => mysql2date( get_option('date_format'), $attachment->post_date ),
         'nonces'      => array(
-            'update' => wp_create_nonce( 'update-post_' . $attachment->ID ),
-            'delete' => wp_create_nonce( 'delete-post_' . $attachment->ID ),
+            'update' => false,
+            'delete' => false,
         ),
     );
+
+    if ( current_user_can( 'edit_post', $attachment->ID ) )
+        $response['nonces']['update'] = wp_create_nonce( 'update-post_' . $attachment->ID );
+
+    if ( current_user_can( 'delete_post', $attachment->ID ) )
+        $response['nonces']['delete'] = wp_create_nonce( 'delete-post_' . $attachment->ID );
 
     if ( $meta && 'image' === $type ) {
@@ -1691 +1697 @@
                     <div class="dimensions">{{ data.width }} &times; {{ data.height }}</div>
                 <# } #>
-                <# if ( ! data.uploading ) { #>
+                <# if ( ! data.uploading && data.can.remove ) { #>
                     <div class="delete-attachment">
                         <a href="#"><?php _e( 'Delete Permanently' ); ?></a>