Changeset 47850

Timestamp:

05/23/2020 03:22:53 PM (5 years ago)

Author:

ocean90

Message:

Role/Capability: Use meta caps edit_post, read_post, and delete_post directly.

Rather than consulting the post type object, let map_meta_cap() handle that for us.

Props peterwilsoncc, ocean90.
Fixes #50128.
See #23226.

Location:

trunk

Files:

• src/wp-includes/class-wp-customize-nav-menus.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-autosaves-controller.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-blocks-controller.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (3 diffs)
• src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-customize-nav-menus.php

@@ -1357 +1357 @@
                 continue;
             }
-            if ( ! current_user_can( $post_type_obj->cap->publish_posts ) || ! current_user_can( $post_type_obj->cap->edit_post, $post_id ) ) {
+            if ( ! current_user_can( $post_type_obj->cap->publish_posts ) || ! current_user_can( 'edit_post', $post_id ) ) {
                 continue;
             }

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -110 +110 @@
 
         // Attaching media to a post requires ability to edit said post.
-        if ( ! empty( $request['post'] ) ) {
-            $parent           = get_post( (int) $request['post'] );
-            $post_parent_type = get_post_type_object( $parent->post_type );
-
-            if ( ! current_user_can( $post_parent_type->cap->edit_post, $request['post'] ) ) {
-                return new WP_Error(
-                    'rest_cannot_edit',
-                    __( 'Sorry, you are not allowed to upload media to this post.' ),
-                    array( 'status' => rest_authorization_required_code() )
-                );
-            }
+        if ( ! empty( $request['post'] ) && ! current_user_can( 'edit_post', (int) $request['post'] ) ) {
+            return new WP_Error(
+                'rest_cannot_edit',
+                __( 'Sorry, you are not allowed to upload media to this post.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
         }
 

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-autosaves-controller.php

@@ -161 +161 @@
         }
 
-        $parent_post_type_obj = get_post_type_object( $parent->post_type );
-
-        if ( ! current_user_can( $parent_post_type_obj->cap->edit_post, $parent->ID ) ) {
+        if ( ! current_user_can( 'edit_post', $parent->ID ) ) {
             return new WP_Error(
                 'rest_cannot_read',

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-blocks-controller.php

@@ -29 +29 @@
      */
     public function check_read_permission( $post ) {
-        // Ensure that the user is logged in and has the read_blocks capability.
-        $post_type = get_post_type_object( $post->post_type );
-        if ( ! current_user_can( $post_type->cap->read_post, $post->ID ) ) {
+        // By default the read_post capability is mapped to edit_posts.
+        if ( ! current_user_can( 'read_post', $post->ID ) ) {
             return false;
         }

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -1775 +1775 @@
 
         if ( post_password_required( $post ) ) {
-            $result = current_user_can( $post_type->cap->edit_post, $post->ID );
+            $result = current_user_can( 'edit_post', $post->ID );
         } else {
             $result = $posts_controller->check_read_permission( $post );

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -1480 +1480 @@
 
         // Is the post readable?
-        if ( 'publish' === $post->post_status || current_user_can( $post_type->cap->read_post, $post->ID ) ) {
+        if ( 'publish' === $post->post_status || current_user_can( 'read_post', $post->ID ) ) {
             return true;
         }
@@ -1523 +1523 @@
         }
 
-        return current_user_can( $post_type->cap->edit_post, $post->ID );
+        return current_user_can( 'edit_post', $post->ID );
     }
 
@@ -1559 +1559 @@
         }
 
-        return current_user_can( $post_type->cap->delete_post, $post->ID );
+        return current_user_can( 'delete_post', $post->ID );
     }
 

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php

@@ -170 +170 @@
         }
 
-        $parent_post_type_obj = get_post_type_object( $parent->post_type );
-
-        if ( ! current_user_can( $parent_post_type_obj->cap->edit_post, $parent->ID ) ) {
+        if ( ! current_user_can( 'edit_post', $parent->ID ) ) {
             return new WP_Error(
                 'rest_cannot_read',
@@ -410 +408 @@
         $parent_post_type = get_post_type_object( $parent->post_type );
 
-        if ( ! current_user_can( $parent_post_type->cap->delete_post, $parent->ID ) ) {
+        if ( ! current_user_can( 'delete_post', $parent->ID ) ) {
             return new WP_Error(
                 'rest_cannot_delete',
@@ -428 +426 @@
         }
 
-        $post_type = get_post_type_object( 'revision' );
-
-        if ( ! current_user_can( $post_type->cap->delete_post, $revision->ID ) ) {
+        if ( ! current_user_can( 'delete_post', $revision->ID ) ) {
             return new WP_Error(
                 'rest_cannot_delete',

trunk/tests/phpunit/tests/rest-api.php

@@ -1324 +1324 @@
     /**
      * @dataProvider rest_ensure_response_data_provider
-     * @group test1
      *
      * @param mixed $response      The response passed to rest_ensure_response().