Changeset 24593

Timestamp:

07/08/2013 08:05:42 PM (12 years ago)

Author:

nacin

Message:

Use meta caps edit_post, read_post, and delete_post directly, rather than consulting the post type object. map_meta_cap() handles that for us. props markjaquith, kovshenin. fixes #23226.

Location:

trunk

Files:

• wp-admin/async-upload.php (modified) (1 diff)
• wp-admin/edit.php (modified) (3 diffs)
• wp-admin/includes/class-wp-posts-list-table.php (modified) (2 diffs)
• wp-admin/includes/media.php (modified) (1 diff)
• wp-admin/includes/post.php (modified) (3 diffs)
• wp-admin/includes/template.php (modified) (1 diff)
• wp-admin/post.php (modified) (4 diffs)
• wp-includes/admin-bar.php (modified) (2 diffs)
• wp-includes/capabilities.php (modified) (2 diffs)
• wp-includes/class-wp-xmlrpc-server.php (modified) (4 diffs)
• wp-includes/link-template.php (modified) (2 diffs)
• wp-includes/query.php (modified) (1 diff)

trunk/wp-admin/async-upload.php

@@ -48 +48 @@
     if ( 'attachment' != $post->post_type )
         wp_die( __( 'Unknown post type.' ) );
-    $post_type_object = get_post_type_object( 'attachment' );
-    if ( ! current_user_can( $post_type_object->cap->edit_post, $id ) )
+    if ( ! current_user_can( 'edit_post', $id ) )
         wp_die( __( 'You are not allowed to edit this item.' ) );
 

trunk/wp-admin/edit.php

@@ -79 +79 @@
 
             foreach( (array) $post_ids as $post_id ) {
-                if ( !current_user_can($post_type_object->cap->delete_post, $post_id) )
+                if ( !current_user_can( 'delete_post', $post_id) )
                     wp_die( __('You are not allowed to move this item to the Trash.') );
 
@@ -98 +98 @@
             $untrashed = 0;
             foreach( (array) $post_ids as $post_id ) {
-                if ( !current_user_can($post_type_object->cap->delete_post, $post_id) )
+                if ( !current_user_can( 'delete_post', $post_id) )
                     wp_die( __('You are not allowed to restore this item from the Trash.') );
 
@@ -113 +113 @@
                 $post_del = get_post($post_id);
 
-                if ( !current_user_can($post_type_object->cap->delete_post, $post_id) )
+                if ( !current_user_can( 'delete_post', $post_id ) )
                     wp_die( __('You are not allowed to delete this item.') );
 

trunk/wp-admin/includes/class-wp-posts-list-table.php

@@ -481 +481 @@
         $title = _draft_or_post_title();
         $post_type_object = get_post_type_object( $post->post_type );
-        $can_edit_post = current_user_can( $post_type_object->cap->edit_post, $post->ID );
+        $can_edit_post = current_user_can( 'edit_post', $post->ID );
 
         $alternate = 'alternate' == $alternate ? '' : 'alternate';
@@ -586 +586 @@
                     $actions['inline hide-if-no-js'] = '<a href="#" class="editinline" title="' . esc_attr( __( 'Edit this item inline' ) ) . '">' . __( 'Quick&nbsp;Edit' ) . '</a>';
                 }
-                if ( current_user_can( $post_type_object->cap->delete_post, $post->ID ) ) {
+                if ( current_user_can( 'delete_post', $post->ID ) ) {
                     if ( 'trash' == $post->post_status )
                         $actions['untrash'] = "<a title='" . esc_attr( __( 'Restore this item from the Trash' ) ) . "' href='" . wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $post->ID ) ), 'untrash-post_' . $post->ID ) . "'>" . __( 'Restore' ) . "</a>";

trunk/wp-admin/includes/media.php

@@ -497 +497 @@
     if ( !empty($_POST['attachments']) ) foreach ( $_POST['attachments'] as $attachment_id => $attachment ) {
         $post = $_post = get_post($attachment_id, ARRAY_A);
-        $post_type_object = get_post_type_object( $post[ 'post_type' ] );
-
-        if ( !current_user_can( $post_type_object->cap->edit_post, $attachment_id ) )
+
+        if ( !current_user_can( 'edit_post', $attachment_id ) )
             continue;
 

trunk/wp-admin/includes/post.php

@@ -29 +29 @@
     $ptype = get_post_type_object( $post_data['post_type'] );
 
-    if ( $update && ! current_user_can( $ptype->cap->edit_post, $post_data['ID'] ) ) {
+    if ( $update && ! current_user_can( 'edit_post', $post_data['ID'] ) ) {
         if ( 'page' == $post_data['post_type'] )
             return new WP_Error( 'edit_others_pages', __( 'You are not allowed to edit pages as this user.' ) );
@@ -173 +173 @@
 
     $ptype = get_post_type_object($post_data['post_type']);
-    if ( !current_user_can( $ptype->cap->edit_post, $post_ID ) ) {
+    if ( !current_user_can( 'edit_post', $post_ID ) ) {
         if ( 'page' == $post_data['post_type'] )
             wp_die( __('You are not allowed to edit this page.' ));
@@ -375 +375 @@
         $post_type_object = get_post_type_object( get_post_type( $post_ID ) );
 
-        if ( !isset( $post_type_object ) || ( isset($children) && in_array($post_ID, $children) ) || !current_user_can( $post_type_object->cap->edit_post, $post_ID ) ) {
+        if ( !isset( $post_type_object ) || ( isset($children) && in_array($post_ID, $children) ) || !current_user_can( 'edit_post', $post_ID ) ) {
             $skipped[] = $post_ID;
             continue;

trunk/wp-admin/includes/template.php

@@ -241 +241 @@
 function get_inline_data($post) {
     $post_type_object = get_post_type_object($post->post_type);
-    if ( ! current_user_can($post_type_object->cap->edit_post, $post->ID) )
+    if ( ! current_user_can( 'edit_post', $post->ID ) )
         return;
 

trunk/wp-admin/post.php

@@ -140 +140 @@
         wp_die( __( 'Unknown post type.' ) );
 
-    if ( ! current_user_can( $post_type_object->cap->edit_post, $post_id ) )
+    if ( ! current_user_can( 'edit_post', $post_id ) )
         wp_die( __( 'You are not allowed to edit this item.' ) );
 
@@ -236 +236 @@
         wp_die( __( 'Unknown post type.' ) );
 
-    if ( ! current_user_can( $post_type_object->cap->delete_post, $post_id ) )
+    if ( ! current_user_can( 'delete_post', $post_id ) )
         wp_die( __( 'You are not allowed to move this item to the Trash.' ) );
 
@@ -260 +260 @@
         wp_die( __( 'Unknown post type.' ) );
 
-    if ( ! current_user_can( $post_type_object->cap->delete_post, $post_id ) )
+    if ( ! current_user_can( 'delete_post', $post_id ) )
         wp_die( __( 'You are not allowed to move this item out of the Trash.' ) );
 
@@ -279 +279 @@
         wp_die( __( 'Unknown post type.' ) );
 
-    if ( ! current_user_can( $post_type_object->cap->delete_post, $post_id ) )
+    if ( ! current_user_can( 'delete_post', $post_id ) )
         wp_die( __( 'You are not allowed to delete this item.' ) );
 

trunk/wp-includes/admin-bar.php

@@ -430 +430 @@
             && 'add' != $current_screen->action
             && ( $post_type_object = get_post_type_object( $post->post_type ) )
-            && current_user_can( $post_type_object->cap->read_post, $post->ID )
+            && current_user_can( 'read_post', $post->ID )
             && ( $post_type_object->public )
             && ( $post_type_object->show_in_admin_bar ) )
@@ -458 +458 @@
         if ( ! empty( $current_object->post_type )
             && ( $post_type_object = get_post_type_object( $current_object->post_type ) )
-            && current_user_can( $post_type_object->cap->edit_post, $current_object->ID )
+            && current_user_can( 'edit_post', $current_object->ID )
             && $post_type_object->show_ui && $post_type_object->show_in_admin_bar )
         {

trunk/wp-includes/capabilities.php

@@ -1163 +1163 @@
     case 'add_post_meta':
         $post = get_post( $args[0] );
-        $post_type_object = get_post_type_object( $post->post_type );
-        $caps = map_meta_cap( $post_type_object->cap->edit_post, $user_id, $post->ID );
+        $caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
 
         $meta_key = isset( $args[ 1 ] ) ? $args[ 1 ] : false;
@@ -1179 +1178 @@
         $comment = get_comment( $args[0] );
         $post = get_post( $comment->comment_post_ID );
-        $post_type_object = get_post_type_object( $post->post_type );
-
-        $caps = map_meta_cap( $post_type_object->cap->edit_post, $user_id, $post->ID );
+        $caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
         break;
     case 'unfiltered_upload':

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -1018 +1018 @@
             if ( ! get_post( $post_data['ID'] ) )
                 return new IXR_Error( 401, __( 'Invalid post ID.' ) );
-            if ( ! current_user_can( $post_type->cap->edit_post, $post_data['ID'] ) )
+            if ( ! current_user_can( 'edit_post', $post_data['ID'] ) )
                 return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this post.' ) );
             if ( $post_data['post_type'] != get_post_type( $post_data['ID'] ) )
@@ -1328 +1328 @@
             return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
-        $post_type = get_post_type_object( $post['post_type'] );
-        if ( ! current_user_can( $post_type->cap->delete_post, $post_id ) )
+        if ( ! current_user_can( 'delete_post', $post_id ) )
             return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this post.' ) );
 
@@ -1410 +1409 @@
             return new IXR_Error( 404, __( 'Invalid post ID.' ) );
 
-        $post_type = get_post_type_object( $post['post_type'] );
-        if ( ! current_user_can( $post_type->cap->edit_post, $post_id ) )
+        if ( ! current_user_can( 'edit_post', $post_id ) )
             return new IXR_Error( 401, __( 'Sorry, you cannot edit this post.' ) );
 
@@ -1506 +1504 @@
 
         foreach ( $posts_list as $post ) {
-            $post_type = get_post_type_object( $post['post_type'] );
-            if ( ! current_user_can( $post_type->cap->edit_post, $post['ID'] ) )
+            if ( ! current_user_can( 'edit_post', $post['ID'] ) )
                 continue;
 

trunk/wp-includes/link-template.php

@@ -907 +907 @@
         return;
 
-    if ( !current_user_can( $post_type_object->cap->edit_post, $post->ID ) )
+    if ( !current_user_can( 'edit_post', $post->ID ) )
         return;
 
@@ -961 +961 @@
         return;
 
-    if ( !current_user_can( $post_type_object->cap->delete_post, $post->ID ) )
+    if ( !current_user_can( 'delete_post', $post->ID ) )
         return;
 

trunk/wp-includes/query.php

@@ -2441 +2441 @@
         }
 
+        $edit_cap = 'edit_post';
+        $read_cap = 'read_post';
+
         if ( ! empty( $post_type_object ) ) {
-            $edit_cap = $post_type_object->cap->edit_post;
-            $read_cap = $post_type_object->cap->read_post;
             $edit_others_cap = $post_type_object->cap->edit_others_posts;
             $read_private_cap = $post_type_object->cap->read_private_posts;
         } else {
-            $edit_cap = 'edit_' . $post_type_cap;
-            $read_cap = 'read_' . $post_type_cap;
             $edit_others_cap = 'edit_others_' . $post_type_cap . 's';
             $read_private_cap = 'read_private_' . $post_type_cap . 's';