Changeset 35747

Timestamp:

11/29/2015 02:24:15 AM (9 years ago)

Author:

johnbillion

Message:

When a post is scheduled for publication, treat it the same as a published post when calculating the capabilities required to edit or delete it.

Fixes #33694

Location:

trunk

Files:

• src/wp-includes/capabilities.php (modified) (4 diffs)
• tests/phpunit/tests/user/capabilities.php (modified) (1 diff)

trunk/src/wp-includes/capabilities.php

@@ -84 +84 @@
         // If the post author is set and the user is the author...
         if ( $post->post_author && $user_id == $post->post_author ) {
-            // If the post is published...
-            if ( 'publish' == $post->post_status ) {
+            // If the post is published or scheduled...
+            if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {
                 $caps[] = $post_type->cap->delete_published_posts;
             } elseif ( 'trash' == $post->post_status ) {
-                if ( 'publish' == get_post_meta( $post->ID, '_wp_trash_meta_status', true ) ) {
+                $status = get_post_meta( $post->ID, '_wp_trash_meta_status', true );
+                if ( in_array( $status, array( 'publish', 'future' ), true ) ) {
                     $caps[] = $post_type->cap->delete_published_posts;
+                } else {
+                    $caps[] = $post_type->cap->delete_posts;
                 }
             } else {
@@ -98 +101 @@
             // The user is trying to edit someone else's post.
             $caps[] = $post_type->cap->delete_others_posts;
-            // The post is published, extra cap required.
-            if ( 'publish' == $post->post_status ) {
+            // The post is published or scheduled, extra cap required.
+            if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {
                 $caps[] = $post_type->cap->delete_published_posts;
             } elseif ( 'private' == $post->post_status ) {
@@ -142 +145 @@
         // If the post author is set and the user is the author...
         if ( $post->post_author && $user_id == $post->post_author ) {
-            // If the post is published...
-            if ( 'publish' == $post->post_status ) {
+            // If the post is published or scheduled...
+            if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {
                 $caps[] = $post_type->cap->edit_published_posts;
             } elseif ( 'trash' == $post->post_status ) {
-                if ( 'publish' == get_post_meta( $post->ID, '_wp_trash_meta_status', true ) ) {
+                $status = get_post_meta( $post->ID, '_wp_trash_meta_status', true );
+                if ( in_array( $status, array( 'publish', 'future' ), true ) ) {
                     $caps[] = $post_type->cap->edit_published_posts;
+                } else {
+                    $caps[] = $post_type->cap->edit_posts;
                 }
             } else {
@@ -156 +162 @@
             // The user is trying to edit someone else's post.
             $caps[] = $post_type->cap->edit_others_posts;
-            // The post is published, extra cap required.
-            if ( 'publish' == $post->post_status ) {
+            // The post is published or scheduled, extra cap required.
+            if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {
                 $caps[] = $post_type->cap->edit_published_posts;
             } elseif ( 'private' == $post->post_status ) {

trunk/tests/phpunit/tests/user/capabilities.php

@@ -982 +982 @@
     }
 
+    /**
+     * @ticket 33694
+     */
+    function test_contributor_cannot_edit_scheduled_post() {
+
+        // Add a contributor
+        $contributor = $this->factory->user->create_and_get( array(
+            'role' => 'contributor',
+        ) );
+
+        // Give them a scheduled post
+        $post = $this->factory->post->create_and_get( array(
+            'post_author' => $contributor->ID,
+            'post_status' => 'future',
+        ) );
+
+        // Ensure contributor can't edit or trash the post
+        $this->assertFalse( user_can( $contributor->ID, 'edit_post', $post->ID ) );
+        $this->assertFalse( user_can( $contributor->ID, 'delete_post', $post->ID ) );
+
+        // Test the tests
+        $this->assertTrue( defined( 'EMPTY_TRASH_DAYS' ) );
+        $this->assertNotEmpty( EMPTY_TRASH_DAYS );
+
+        // Trash it
+        $trashed = wp_trash_post( $post->ID );
+        $this->assertNotEmpty( $trashed );
+
+        // Ensure contributor can't edit, un-trash, or delete the post
+        $this->assertFalse( user_can( $contributor->ID, 'edit_post', $post->ID ) );
+        $this->assertFalse( user_can( $contributor->ID, 'delete_post', $post->ID ) );
+
+    }
+
     function test_multisite_administrator_with_manage_network_users_can_edit_users() {
         if ( ! is_multisite() ) {