Changeset 27390

Timestamp:

03/04/2014 03:08:54 AM (12 years ago)

Author:

nacin

Message:

Don't default to current user for capability checks when dealing with a post without an author (post_author = 0).

Undoes [12053]. While it risks breakage, this is a far safer and saner default for these situations.

props danielbachhuber.
fixes #27020.

Location:

trunk

Files:

• src/wp-includes/capabilities.php (modified) (5 diffs)
• tests/phpunit/tests/user/capabilities.php (modified) (1 diff)
• tests/phpunit/tests/user/mapMetaCap.php (modified) (1 diff)

trunk/src/wp-includes/capabilities.php

@@ -1072 +1072 @@
         }
 
-        $post_author_id = $post->post_author;
-
-        // If no author set yet, default to current user for cap checks.
-        if ( ! $post_author_id )
-            $post_author_id = $user_id;
-
-        // If the user is the author...
-        if ( $user_id == $post_author_id ) {
+        // If the post author is set and the user is the author...
+        if ( $post->post_author && $user_id == $post->post_author ) {
             // If the post is published...
             if ( 'publish' == $post->post_status ) {
                 $caps[] = $post_type->cap->delete_published_posts;
             } elseif ( 'trash' == $post->post_status ) {
-                if ('publish' == get_post_meta($post->ID, '_wp_trash_meta_status', true) )
+                if ( 'publish' == get_post_meta( $post->ID, '_wp_trash_meta_status', true ) ) {
                     $caps[] = $post_type->cap->delete_published_posts;
+                }
             } else {
                 // If the post is draft...
@@ -1094 +1089 @@
             $caps[] = $post_type->cap->delete_others_posts;
             // The post is published, extra cap required.
-            if ( 'publish' == $post->post_status )
+            if ( 'publish' == $post->post_status ) {
                 $caps[] = $post_type->cap->delete_published_posts;
-            elseif ( 'private' == $post->post_status )
+            } elseif ( 'private' == $post->post_status ) {
                 $caps[] = $post_type->cap->delete_private_posts;
+            }
         }
         break;
@@ -1122 +1118 @@
         }
 
-        $post_author_id = $post->post_author;
-
-        // If no author set yet, default to current user for cap checks.
-        if ( ! $post_author_id )
-            $post_author_id = $user_id;
-
-        // If the user is the author...
-        if ( $user_id == $post_author_id ) {
+        // If the post author is set and the user is the author...
+        if ( $post->post_author && $user_id == $post->post_author ) {
             // If the post is published...
             if ( 'publish' == $post->post_status ) {
                 $caps[] = $post_type->cap->edit_published_posts;
             } elseif ( 'trash' == $post->post_status ) {
-                if ('publish' == get_post_meta($post->ID, '_wp_trash_meta_status', true) )
+                if ( 'publish' == get_post_meta( $post->ID, '_wp_trash_meta_status', true ) ) {
                     $caps[] = $post_type->cap->edit_published_posts;
+                }
             } else {
                 // If the post is draft...
@@ -1144 +1135 @@
             $caps[] = $post_type->cap->edit_others_posts;
             // The post is published, extra cap required.
-            if ( 'publish' == $post->post_status )
+            if ( 'publish' == $post->post_status ) {
                 $caps[] = $post_type->cap->edit_published_posts;
-            elseif ( 'private' == $post->post_status )
+            } elseif ( 'private' == $post->post_status ) {
                 $caps[] = $post_type->cap->edit_private_posts;
+            }
         }
         break;
@@ -1174 +1166 @@
         }
 
-        $post_author_id = $post->post_author;
-
-        // If no author set yet, default to current user for cap checks.
-        if ( ! $post_author_id )
-            $post_author_id = $user_id;
-
-        if ( $user_id == $post_author_id )
+        if ( $post->post_author && $user_id == $post->post_author ) {
             $caps[] = $post_type->cap->read;
-        elseif ( $status_obj->private )
+        } elseif ( $status_obj->private ) {
             $caps[] = $post_type->cap->read_private_posts;
-        else
+        } else {
             $caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
+        }
         break;
     case 'publish_post':

trunk/tests/phpunit/tests/user/capabilities.php

@@ -523 +523 @@
             $this->assertFalse( $admin->has_cap('delete_post_meta',  $post, 'not_protected') );
         }
+    }
+
+    function authorless_post_statuses() {
+        return array( array( 'draft' ), array( 'private' ), array( 'publish' ) );
+    }
+
+    /**
+     * @ticket 27020
+     * @dataProvider authorless_post_statuses
+     */
+    function test_authorless_post( $status ) {
+        // Make a post without an author
+        $post = $this->factory->post->create( array( 'post_author' => 0, 'post_type' => 'post', 'post_status' => $status ) );
+
+        // Add an editor and contributor
+        $editor = $this->factory->user->create_and_get( array( 'role' => 'editor' ) );
+        $contributor = $this->factory->user->create_and_get( array( 'role' => 'contributor' ) );
+
+        // editor can edit, view, and trash
+        $this->assertTrue( $editor->has_cap( 'edit_post', $post ) );
+        $this->assertTrue( $editor->has_cap( 'delete_post', $post ) );
+        $this->assertTrue( $editor->has_cap( 'read_post', $post ) );
+
+        // a contributor cannot (except read a published post)
+        $this->assertFalse( $contributor->has_cap( 'edit_post', $post ) );
+        $this->assertFalse( $contributor->has_cap( 'delete_post', $post ) );
+        $this->assertEquals( $status === 'publish', $contributor->has_cap( 'read_post', $post ) );
     }
 

trunk/tests/phpunit/tests/user/mapMetaCap.php

@@ -233 +233 @@
         $this->assertEquals( array( 'edit_plugins' ), map_meta_cap( 'edit_plugins', $this->user_id ) );
     }
+
+    /**
+     * Test a post without an author.
+     *
+     * @ticket 27020
+     */
+    function test_authorless_posts_capabilties() {
+        $post_id = $this->factory->post->create( array( 'post_author' => 0, 'post_type' => 'post', 'post_status' => 'publish' ) );
+        $editor = $this->factory->user->create( array( 'role' => 'editor' ) );
+
+        $this->assertEquals( array( 'edit_others_posts', 'edit_published_posts' ), map_meta_cap( 'edit_post', $editor, $post_id ) );
+        $this->assertEquals( array( 'delete_others_posts', 'delete_published_posts' ), map_meta_cap( 'delete_post', $editor, $post_id ) );
+
+    }
 }