Changeset 27596

Timestamp:

03/18/2014 10:43:41 PM (7 years ago)

Author:

johnbillion

Message:

Introduce permission checks for post queries and edit links in the At a Glance dashboard widget. Fixes #27132. Props mattheu.

File:

• trunk/src/wp-admin/includes/dashboard.php (modified) (3 diffs)

trunk/src/wp-admin/includes/dashboard.php

@@ -430 +430 @@
     $GLOBALS['comment'] =& $comment;
 
-    $comment_post_url = get_edit_post_link( $comment->comment_post_ID );
     $comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
-    $comment_post_link = "<a href='$comment_post_url'>$comment_post_title</a>";
+
+    if ( current_user_can( 'edit_post', $comment->comment_post_ID ) ) {
+        $comment_post_url = get_edit_post_link( $comment->comment_post_ID );
+        $comment_post_link = "<a href='$comment_post_url'>$comment_post_title</a>";
+    } else {
+        $comment_post_link = $comment_post_title;
+    }
+
     $comment_link = '<a class="comment-link" href="' . esc_url(get_comment_link()) . '">#</a>';
 
@@ -581 +587 @@
         'posts_per_page' => intval( $args['max'] ),
         'no_found_rows'  => true,
-        'cache_results'  => false
+        'cache_results'  => false,
+        'perm'           => ( 'future' === $args['status'] ) ? 'editable' : 'readable',
     );
     $posts = new WP_Query( $query_args );
@@ -610 +617 @@
             }
 
+            if ( current_user_can( 'edit_post', get_the_ID() ) ) {
+                /* translators: 1: relative date, 2: time, 3: post edit link, 4: post title */
+                $format = __( '<span>%1$s, %2$s</span> <a href="%3$s">%4$s</a>' );
+            } else {
+                /* translators: 1: relative date, 2: time, 4: post title */
+                $format = __( '<span>%1$s, %2$s</span> %4$s' );
+            }
+
             $text = sprintf(
-                /* translators: 1: relative date, 2: time, 4: post title */
-                __( '<span>%1$s, %2$s</span> <a href="%3$s">%4$s</a>' ),
+                $format,
                 $relative,
                 get_the_time(),