Changeset 48211 for trunk/src/wp-includes/class-wp-customize-manager.php

Timestamp:

06/29/2020 10:31:12 AM (6 years ago)

Author:

SergeyBiryukov

Message:

Customize: Do not allow changesets to be deleted when someone is editing them.

This makes the behavior consistent with that of locked posts, which can't be deleted via the list tables when another user is editing them.

Props dlh.
Fixes #50501.

File:

• trunk/src/wp-includes/class-wp-customize-manager.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-customize-manager.php

@@ -3140 +3140 @@
                 }
 
-                if ( $changeset_post_id && ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) {
-                        wp_send_json_error(
-                                array(
-                                        'code'    => 'changeset_trash_unauthorized',
-                                        'message' => __( 'Unable to trash changes.' ),
-                                )
-                        );
+                if ( $changeset_post_id ) {
+                        if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) {
+                                wp_send_json_error(
+                                        array(
+                                                'code'    => 'changeset_trash_unauthorized',
+                                                'message' => __( 'Unable to trash changes.' ),
+                                        )
+                                );
+                        }
+
+                        $lock_user = (int) wp_check_post_lock( $changeset_post_id );
+
+                        if ( $lock_user && get_current_user_id() !== $lock_user ) {
+                                wp_send_json_error(
+                                        array(
+                                                'code'     => 'changeset_locked',
+                                                'message'  => __( 'Changeset is being edited by other user.' ),
+                                                'lockUser' => $this->get_lock_user_data( $lock_user ),
+                                        )
+                                );
+                        }
                 }