Context Navigation

← Previous Change
Next Change →

capabilities.php

Timestamp:

08/15/2019 10:00:49 PM (7 years ago)

Author:

kadamwhite

Message:

REST API: Prevent deletion of post revisions.

Allowing the client to delete revisions breaks the "audit trail" functionality. This is not allowed in WordPress and shouldn't be allowed through the API.
While not recommended, a plugin may opt-in to the previous behavior by setting a custom 'delete_post' capability for the revisions post type.

Props dlh, danielbachhuber, TimothyBlynJacobs, azaozz, kadamwhite.
Fixes #43709.

File:

: 1 edited

trunk/src/wp-includes/capabilities.php (modified) (1 diff)

Legend:

: Unmodified
: Added
: Removed

trunk/src/wp-includes/capabilities.php

-              r45734
+              r45812
                         if ( 'revision' == $post->post_type ) {
+                                $post = get_post( $post->post_parent );
+                                if ( ! $post ) {
+                                        $caps[] = 'do_not_allow';
+                                        break;
+                                }
+                                $caps[] = 'do_not_allow';
+                                break;
+                        }

Note: See TracChangeset for help on using the changeset viewer.

Make WordPress Core

Context Navigation

Changeset 45812 for trunk/src/wp-includes/capabilities.php

Legend:

trunk/src/wp-includes/capabilities.php

Download in other formats: