WordPress.org

Make WordPress Core

Changeset 33375


Ignore:
Timestamp:
07/23/2015 03:53:06 AM (4 years ago)
Author:
pento
Message:

Capabilities: When creating an auto-draft, ensure that the current user still has permission to do so.

Merge of [33357] to the 4.1 branch.

Location:
branches/4.1
Files:
4 edited

Legend:

Unmodified
Added
Removed
  • branches/4.1/src/wp-admin/includes/dashboard.php

    r32176 r33375  
    416416function wp_dashboard_quick_press( $error_msg = false ) {
    417417    global $post_ID;
     418
     419    if ( ! current_user_can( 'edit_posts' ) ) {
     420        return;
     421    }
    418422
    419423    /* Check if a new auto-draft (= no new post_ID) is needed or if the old can be used */
  • branches/4.1/src/wp-admin/post.php

    r29572 r33375  
    114114        $error_msg = __( 'Unable to submit this form, please refresh and try again.' );
    115115
    116     if ( ! current_user_can( 'edit_posts' ) )
    117         $error_msg = __( 'Oops, you don’t have access to add new drafts.' );
     116    if ( ! current_user_can( 'edit_posts' ) ) {
     117        exit;
     118    }
    118119
    119120    if ( $error_msg )
  • branches/4.1/src/wp-includes/capabilities.php

    r32174 r33375  
    11181118    case 'edit_page':
    11191119        $post = get_post( $args[0] );
    1120         if ( empty( $post ) )
     1120        if ( empty( $post ) ) {
     1121            $caps[] = 'do_not_allow';
    11211122            break;
     1123        }
    11221124
    11231125        if ( 'revision' == $post->post_type ) {
  • branches/4.1/tests/phpunit/tests/user/capabilities.php

    r32179 r33375  
    726726        wp_set_current_user( $old_uid );
    727727    }
     728
     729    function test_subscriber_cant_edit_posts() {
     730        $user = new WP_User( $this->factory->user->create( array( 'role' => 'subscriber' ) ) );
     731        wp_set_current_user( $user->ID );
     732
     733        $post = $this->factory->post->create( array( 'post_author' => 1 ) );
     734
     735        $this->assertFalse( current_user_can( 'edit_post', $post ) );
     736        $this->assertFalse( current_user_can( 'edit_post', $post + 1 ) );
     737    }
    728738}
Note: See TracChangeset for help on using the changeset viewer.