Make WordPress Core


Ignore:
Timestamp:
09/30/2016 10:39:32 PM (8 years ago)
Author:
johnbillion
Message:

Taxonomy: Introduce more fine grained capabilities for managing taxonomy terms.

This introduces the singular edit_term, delete_term, and assign_term meta capabilities for terms, and switches the base capability name for tags from manage_categories to manage_post_tags and the corresponding edit_post_tags, delete_post_tags, and assign_post_tags.

All of these capabilities ultimately map to manage_categories so by default there is no change in the behaviour of the capabilities for categories, tags, or custom taxonomies. The map_meta_cap filter and the capabilities argument when registering a taxonomy now allow for control over editing, deleting, and assigning individual terms, as well as a separation of capabilities for tags from those of categories.

Fixes #35614
Props johnjamesjacoby for feedback

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/includes/ajax-actions.php

    r38666 r38698  
    595595    check_ajax_referer( "delete-tag_$tag_id" );
    596596
     597    if ( ! current_user_can( 'delete_term', $tag_id ) ) {
     598        wp_die( -1 );
     599    }
     600
    597601    $taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';
    598     $tax = get_taxonomy($taxonomy);
    599 
    600     if ( !current_user_can( $tax->cap->delete_terms ) )
    601         wp_die( -1 );
    602 
    603602    $tag = get_term( $tag_id, $taxonomy );
    604603    if ( !$tag || is_wp_error( $tag ) )
     
    797796        $action = 'add-link-category';
    798797    check_ajax_referer( $action );
    799     if ( !current_user_can( 'manage_categories' ) )
    800         wp_die( -1 );
     798    $tax = get_taxonomy( 'link_category' );
     799    if ( ! current_user_can( $tax->cap->manage_terms ) ) {
     800        wp_die( -1 );
     801    }
    801802    $names = explode(',', wp_unslash( $_POST['newcat'] ) );
    802803    $x = new WP_Ajax_Response();
     
    17041705        wp_die( 0 );
    17051706
    1706     if ( ! current_user_can( $tax->cap->edit_terms ) )
    1707         wp_die( -1 );
     1707    if ( ! isset( $_POST['tax_ID'] ) || ! ( $id = (int) $_POST['tax_ID'] ) ) {
     1708        wp_die( -1 );
     1709    }
     1710
     1711    if ( ! current_user_can( 'edit_term', $id ) ) {
     1712        wp_die( -1 );
     1713    }
    17081714
    17091715    $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
    1710 
    1711     if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) )
    1712         wp_die( -1 );
    17131716
    17141717    $tag = get_term( $id, $taxonomy );
Note: See TracChangeset for help on using the changeset viewer.