Changeset 2441

Timestamp:

03/14/2005 12:48:11 AM (20 years ago)

Author:

ryan

Message:

Don't let users who cannot publish edit published posts, even their own. Make consistent use of user_can_create_post(). ​http://mosquito.wordpress.org/view.php?id=1004 Props: MC_incubus

Location:

trunk

Files:

• wp-admin/edit-form-advanced.php (modified) (2 diffs)
• wp-admin/edit-form.php (modified) (1 diff)
• wp-admin/post.php (modified) (3 diffs)
• wp-register.php (modified) (1 diff)

trunk/wp-admin/edit-form-advanced.php

@@ -116 +116 @@
 if ('publish' != $post_status || 0 == $post_ID) {
 ?>
-<?php if ( 1 < $user_level || (1 == $user_level && 2 == get_option('new_users_can_blog')) ) : ?>
+<?php if ( user_can_create_post($user_ID) ) : ?>
     <input name="publish" type="submit" id="publish" tabindex="10" value="<?php _e('Publish') ?>" /> 
 <?php endif; ?>
@@ -136 +136 @@
     <tr>
         <th scope="row" valign="top"><?php _e('Post Status') ?>:</th>
-        <td><?php if ( 1 < $user_level || (1 == $user_level && 2 == get_option('new_users_can_blog')) ) : ?>
+        <td><?php if ( user_can_create_post($user_ID) ) : ?>
 <label for="post_status_publish" class="selectit"><input id="post_status_publish" name="post_status" type="radio" value="publish" <?php checked($post_status, 'publish'); ?> /> <?php _e('Published') ?></label><br />
 <?php endif; ?>

trunk/wp-admin/edit-form.php

@@ -59 +59 @@
   <input name="saveasprivate" type="submit" id="saveasprivate" tabindex="10" value="<?php _e('Save as Private') ?>" />
 
-<?php if ( 1 < $user_level || (1 == $user_level && 2 == get_option('new_users_can_blog')) ) : ?>
+     <?php if ( user_can_create_post($user_ID) ) : ?>
   <input name="publish" type="submit" id="publish" tabindex="6" style="font-weight: bold;" value="<?php _e('Publish') ?>" /> 
 <?php endif; ?>

trunk/wp-admin/post.php

@@ -62 +62 @@
         $post_status = 'draft';
     // Double-check
-    if ( 'publish' == $post_status && (!user_can_create_post($user_ID)) && 2 != get_option('new_users_can_blog') )
+    if ( 'publish' == $post_status && (!user_can_create_post($user_ID)) )
         $post_status = 'draft';
     $comment_status = $_POST['comment_status'];
@@ -230 +230 @@
         die ( __('You are not allowed to view other users\' private posts.') );
 
+    if ( 'publish' == $post_status && (!user_can_create_post($user_ID)) ) {
+         _e('You are not allowed to edit published posts.');
+         break;
+    }
+
     if ($post_status == 'static') {
         $page_template = get_post_meta($post_ID, '_wp_page_template', true);
@@ -306 +311 @@
     if (isset($_POST['publish'])) $post_status = 'publish';
     // Double-check
-    if ( 'publish' == $post_status && (!user_can_create_post($user_ID)) && 2 != get_option('new_users_can_blog') )
+    if ( 'publish' == $post_status && (!user_can_create_post($user_ID)) )
         $post_status = 'draft';
 

trunk/wp-register.php

@@ -55 +55 @@
    $user_nicename = sanitize_title($user_nickname);
     $now = gmdate('Y-m-d H:i:s');
-    if (get_settings('new_users_can_blog') >= 1) $user_level = 1;
+    $user_level = get_settings('new_users_can_blog');
     $password = substr( md5( uniqid( microtime() ) ), 0, 7);