Changeset 37941

Timestamp:

07/01/2016 03:06:54 PM (8 years ago)

Author:

helen

Message:

Media: Only show parent post titles when the user can read said post.

fixes #37186.

Location:

trunk/src

Files:

• wp-admin/includes/class-wp-media-list-table.php (modified) (3 diffs)
• wp-includes/media.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-media-list-table.php

@@ -477 +477 @@
             $title = _draft_or_post_title( $post->post_parent );
             $parent_type = get_post_type_object( $parent->post_type );
+            
+            if ( $parent_type && $parent_type->show_ui && current_user_can( 'edit_post', $post->post_parent ) ) {
 ?>
-            <strong>
-            <?php if ( $parent_type && $parent_type->show_ui && current_user_can( 'edit_post', $post->post_parent ) ) { ?>
-                <a href="<?php echo get_edit_post_link( $post->post_parent ); ?>">
-                    <?php echo $title ?></a><?php
+                <strong><a href="<?php echo get_edit_post_link( $post->post_parent ); ?>">
+                    <?php echo $title ?></a></strong><?php
+            } elseif ( current_user_can( 'read_post', $post->post_parent ) ) {
+?>
+                <strong><?php echo $title ?></strong><?php
             } else {
-                echo $title;
-            } ?></strong>
-            <br />
-            <?php
+                _e( '(Private post)' );
+            }
+
             if ( $user_can_edit ):
                 $detach_url = add_query_arg( array(
@@ -494 +496 @@
                 ), 'upload.php' );
                 printf(
-                    '<a href="%s" class="hide-if-no-js detach-from-parent" aria-label="%s">%s</a>',
+                    '<br /><a href="%s" class="hide-if-no-js detach-from-parent" aria-label="%s">%s</a>',
                     $detach_url,
                     /* translators: %s: title of the post the attachment is attached to */
@@ -502 +504 @@
             endif;
         } else {
-            _e( '(Unattached)' ); ?><br />
+            _e( '(Unattached)' ); ?>
             <?php if ( $user_can_edit ) {
                 $title = _draft_or_post_title( $post->post_parent );
                 printf(
-                    '<a href="#the-list" onclick="findPosts.open( \'media[]\', \'%s\' ); return false;" class="hide-if-no-js" aria-label="%s">%s</a>',
+                    '<br /><a href="#the-list" onclick="findPosts.open( \'media[]\', \'%s\' ); return false;" class="hide-if-no-js" aria-label="%s">%s</a>',
                     $post->ID,
                     /* translators: %s: attachment title */

trunk/src/wp-includes/media.php

@@ -3066 +3066 @@
             $response['uploadedToLink'] = get_edit_post_link( $attachment->post_parent, 'raw' );
         }
-        $response['uploadedToTitle'] = $post_parent->post_title ? $post_parent->post_title : __( '(no title)' );
+
+        if ( current_user_can( 'read_post', $attachment->post_parent ) ) {
+            $response['uploadedToTitle'] = $post_parent->post_title ? $post_parent->post_title : __( '(no title)' );
+        }
     }