Changeset 38698 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

09/30/2016 10:39:32 PM (8 years ago)

Author:

johnbillion

Message:

Taxonomy: Introduce more fine grained capabilities for managing taxonomy terms.

This introduces the singular edit_term, delete_term, and assign_term meta capabilities for terms, and switches the base capability name for tags from manage_categories to manage_post_tags and the corresponding edit_post_tags, delete_post_tags, and assign_post_tags.

All of these capabilities ultimately map to manage_categories so by default there is no change in the behaviour of the capabilities for categories, tags, or custom taxonomies. The map_meta_cap filter and the capabilities argument when registering a taxonomy now allow for control over editing, deleting, and assigning individual terms, as well as a separation of capabilities for tags from those of categories.

Fixes #35614
Props johnjamesjacoby for feedback

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (7 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -1887 +1887 @@
         $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
 
-        if ( ! current_user_can( $taxonomy->cap->manage_terms ) )
+        if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) {
             return new IXR_Error( 401, __( 'Sorry, you are not allowed to create terms in this taxonomy.' ) );
+        }
 
         $taxonomy = (array) $taxonomy;
@@ -1974 +1975 @@
         $taxonomy = get_taxonomy( $content_struct['taxonomy'] );
 
-        if ( ! current_user_can( $taxonomy->cap->edit_terms ) )
-            return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit terms in this taxonomy.' ) );
-
         $taxonomy = (array) $taxonomy;
 
@@ -1989 +1987 @@
         if ( ! $term )
             return new IXR_Error( 404, __( 'Invalid term ID.' ) );
+
+        if ( ! current_user_can( 'edit_term', $term_id ) ) {
+            return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this term.' ) );
+        }
 
         if ( isset( $content_struct['name'] ) ) {
@@ -2069 +2071 @@
 
         $taxonomy = get_taxonomy( $taxonomy );
-
-        if ( ! current_user_can( $taxonomy->cap->delete_terms ) )
-            return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete terms in this taxonomy.' ) );
-
         $term = get_term( $term_id, $taxonomy->name );
 
@@ -2080 +2078 @@
         if ( ! $term )
             return new IXR_Error( 404, __( 'Invalid term ID.' ) );
+
+        if ( ! current_user_can( 'delete_term', $term_id ) ) {
+            return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this term.' ) );
+        }
 
         $result = wp_delete_term( $term_id, $taxonomy->name );
@@ -2141 +2143 @@
         $taxonomy = get_taxonomy( $taxonomy );
 
-        if ( ! current_user_can( $taxonomy->cap->assign_terms ) )
-            return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
-
         $term = get_term( $term_id , $taxonomy->name, ARRAY_A );
 
@@ -2151 +2150 @@
         if ( ! $term )
             return new IXR_Error( 404, __( 'Invalid term ID.' ) );
+
+        if ( ! current_user_can( 'assign_term', $term_id ) ) {
+            return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign this term.' ) );
+        }
 
         return $this->_prepare_term( $term );