Changeset 47357

Timestamp:

02/25/2020 12:48:11 PM (5 years ago)

Author:

SergeyBiryukov

Message:

Posts, Post Types: Ensure delete_posts is included in default post type capabilities regardless of map_meta_cap value.

This resolves PHP notices in a few places in core where this capability is checked.

Props Mte90, johnbillion, dipesh.kakadiya, jipmoors, bamadesigner, dd32, johnjamesjacoby, xedin.unknown, flixos90, SergeyBiryukov.
Fixes #30991.

Location:

trunk

Files:

• src/wp-includes/post.php (modified) (5 diffs)
• tests/phpunit/tests/user/mapMetaCap.php (modified) (1 diff)

trunk/src/wp-includes/post.php

@@ -1510 +1510 @@
  * registration, capability_type will always be a string of the singular value.
  *
- * By default, seven keys are accepted as part of the capabilities array:
+ * By default, eight keys are accepted as part of the capabilities array:
  *
  * - edit_post, read_post, and delete_post are meta capabilities, which are then
@@ -1522 +1522 @@
  *   can be edited. If the post type does not support an author, then this will
  *   behave like edit_posts.
+ * - delete_posts - Controls whether objects of this post type can be deleted.
  * - publish_posts - Controls publishing objects of this post type.
  * - read_private_posts - Controls whether private objects can be read.
  *
- * These four primitive capabilities are checked in core in various locations.
- * There are also seven other primitive capabilities which are not referenced
+ * These five primitive capabilities are checked in core in various locations.
+ * There are also six other primitive capabilities which are not referenced
  * directly in core, except in map_meta_cap(), which takes the three aforementioned
  * meta capabilities and translates them into one or more primitive capabilities
@@ -1532 +1533 @@
  *
  * - read - Controls whether objects of this post type can be read.
- * - delete_posts - Controls whether objects of this post type can be deleted.
  * - delete_private_posts - Controls whether private objects can be deleted.
  * - delete_published_posts - Controls whether published objects can be deleted.
@@ -1569 +1569 @@
         'edit_posts'         => 'edit_' . $plural_base,
         'edit_others_posts'  => 'edit_others_' . $plural_base,
+        'delete_posts'       => 'delete_' . $plural_base,
         'publish_posts'      => 'publish_' . $plural_base,
         'read_private_posts' => 'read_private_' . $plural_base,
@@ -1577 +1578 @@
         $default_capabilities_for_mapping = array(
             'read'                   => 'read',
-            'delete_posts'           => 'delete_' . $plural_base,
             'delete_private_posts'   => 'delete_private_' . $plural_base,
             'delete_published_posts' => 'delete_published_' . $plural_base,

trunk/tests/phpunit/tests/user/mapMetaCap.php

@@ -305 +305 @@
     }
 
+    /**
+     * @ticket 30991
+     */
+    function test_delete_posts_cap_without_map_meta_cap() {
+        register_post_type(
+            self::$post_type,
+            array(
+                'capability_type' => 'post',
+                'map_meta_cap'    => false,
+            )
+        );
+
+        $post_type_object = get_post_type_object( self::$post_type );
+
+        $this->assertFalse( $post_type_object->map_meta_cap );
+        $this->assertEquals( 'delete_posts', $post_type_object->cap->delete_posts );
+    }
+
     function test_unfiltered_html_cap() {
         if ( defined( 'DISALLOW_UNFILTERED_HTML' ) ) {