Index: /trunk/src/wp-includes/capabilities.php
===================================================================
--- /trunk/src/wp-includes/capabilities.php (revision 53407)
+++ /trunk/src/wp-includes/capabilities.php (revision 53408)
@@ -74,4 +74,23 @@
case 'delete_post':
case 'delete_page':
+ if ( ! isset( $args[0] ) ) {
+ if ( 'delete_post' === $cap ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific post.' );
+ } else {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific page.' );
+ }
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf( $message, '' . $cap . '
' ),
+ '6.1.0'
+ );
+
+ $caps[] = 'do_not_allow';
+ break;
+ }
+
$post = get_post( $args[0] );
if ( ! $post ) {
@@ -93,5 +112,16 @@
if ( ! $post_type ) {
/* translators: 1: Post type, 2: Capability name. */
- _doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );
+ $message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf(
+ $message,
+ '' . $post->post_type . '
',
+ '' . $cap . '
'
+ ),
+ '4.4.0'
+ );
+
$caps[] = 'edit_others_posts';
break;
@@ -147,4 +177,23 @@
case 'edit_post':
case 'edit_page':
+ if ( ! isset( $args[0] ) ) {
+ if ( 'edit_post' === $cap ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific post.' );
+ } else {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific page.' );
+ }
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf( $message, '' . $cap . '
' ),
+ '6.1.0'
+ );
+
+ $caps[] = 'do_not_allow';
+ break;
+ }
+
$post = get_post( $args[0] );
if ( ! $post ) {
@@ -164,5 +213,16 @@
if ( ! $post_type ) {
/* translators: 1: Post type, 2: Capability name. */
- _doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );
+ $message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf(
+ $message,
+ '' . $post->post_type . '
',
+ '' . $cap . '
'
+ ),
+ '4.4.0'
+ );
+
$caps[] = 'edit_others_posts';
break;
@@ -216,4 +276,23 @@
case 'read_post':
case 'read_page':
+ if ( ! isset( $args[0] ) ) {
+ if ( 'read_post' === $cap ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific post.' );
+ } else {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific page.' );
+ }
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf( $message, '' . $cap . '
' ),
+ '6.1.0'
+ );
+
+ $caps[] = 'do_not_allow';
+ break;
+ }
+
$post = get_post( $args[0] );
if ( ! $post ) {
@@ -233,5 +312,16 @@
if ( ! $post_type ) {
/* translators: 1: Post type, 2: Capability name. */
- _doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );
+ $message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf(
+ $message,
+ '' . $post->post_type . '
',
+ '' . $cap . '
'
+ ),
+ '4.4.0'
+ );
+
$caps[] = 'edit_others_posts';
break;
@@ -250,5 +340,16 @@
if ( ! $status_obj ) {
/* translators: 1: Post status, 2: Capability name. */
- _doing_it_wrong( __FUNCTION__, sprintf( __( 'The post status %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post with that status.' ), get_post_status( $post ), $cap ), '5.4.0' );
+ $message = __( 'The post status %1$s is not registered, so it may not be reliable to check the capability %2$s against a post with that status.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf(
+ $message,
+ '' . get_post_status( $post ) . '
',
+ '' . $cap . '
'
+ ),
+ '5.4.0'
+ );
+
$caps[] = 'edit_others_posts';
break;
@@ -269,4 +370,18 @@
break;
case 'publish_post':
+ if ( ! isset( $args[0] ) ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific post.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf( $message, '' . $cap . '
' ),
+ '6.1.0'
+ );
+
+ $caps[] = 'do_not_allow';
+ break;
+ }
+
$post = get_post( $args[0] );
if ( ! $post ) {
@@ -278,5 +393,16 @@
if ( ! $post_type ) {
/* translators: 1: Post type, 2: Capability name. */
- _doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );
+ $message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf(
+ $message,
+ '' . $post->post_type . '
',
+ '' . $cap . '
'
+ ),
+ '4.4.0'
+ );
+
$caps[] = 'edit_others_posts';
break;
@@ -298,5 +424,31 @@
case 'add_user_meta':
$object_type = explode( '_', $cap )[1];
- $object_id = (int) $args[0];
+
+ if ( ! isset( $args[0] ) ) {
+ if ( 'post' === $object_type ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific post.' );
+ } elseif ( 'comment' === $object_type ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific comment.' );
+ } elseif ( 'term' === $object_type ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific term.' );
+ } else {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific user.' );
+ }
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf( $message, '' . $cap . '
' ),
+ '6.1.0'
+ );
+
+ $caps[] = 'do_not_allow';
+ break;
+ }
+
+ $object_id = (int) $args[0];
$object_subtype = get_object_subtype( $object_type, $object_id );
@@ -393,4 +545,18 @@
break;
case 'edit_comment':
+ if ( ! isset( $args[0] ) ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific comment.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf( $message, '' . $cap . '
' ),
+ '6.1.0'
+ );
+
+ $caps[] = 'do_not_allow';
+ break;
+ }
+
$comment = get_comment( $args[0] );
if ( ! $comment ) {
@@ -533,4 +699,18 @@
case 'delete_term':
case 'assign_term':
+ if ( ! isset( $args[0] ) ) {
+ /* translators: %s: Capability name. */
+ $message = __( 'When checking for the %s capability, you must always check it against a specific term.' );
+
+ _doing_it_wrong(
+ __FUNCTION__,
+ sprintf( $message, '' . $cap . '
' ),
+ '6.1.0'
+ );
+
+ $caps[] = 'do_not_allow';
+ break;
+ }
+
$term_id = (int) $args[0];
$term = get_term( $term_id );
Index: /trunk/tests/phpunit/tests/user.php
===================================================================
--- /trunk/tests/phpunit/tests/user.php (revision 53407)
+++ /trunk/tests/phpunit/tests/user.php (revision 53408)
@@ -1975,5 +1975,5 @@
);
- // _doing_wrong() should be called because the filter callback
+ // _doing_it_wrong() should be called because the filter callback
// adds a item with a 'name' that is the same as one generated by core.
$this->setExpectedIncorrectUsage( 'wp_user_personal_data_exporter' );
Index: /trunk/tests/phpunit/tests/user/capabilities.php
===================================================================
--- /trunk/tests/phpunit/tests/user/capabilities.php (revision 53407)
+++ /trunk/tests/phpunit/tests/user/capabilities.php (revision 53408)
@@ -1596,4 +1596,5 @@
$editor = self::$users['editor'];
+ $this->setExpectedIncorrectUsage( 'map_meta_cap' );
foreach ( $caps as $cap ) {
// `null` represents a non-existent term ID.
Index: /trunk/tests/phpunit/tests/user/mapMetaCap.php
===================================================================
--- /trunk/tests/phpunit/tests/user/mapMetaCap.php (revision 53407)
+++ /trunk/tests/phpunit/tests/user/mapMetaCap.php (revision 53408)
@@ -4,4 +4,5 @@
* @group user
* @group capabilities
+ * @covers ::map_meta_cap
*/
class Tests_User_MapMetaCap extends WP_UnitTestCase {
@@ -411,3 +412,50 @@
$this->assertSame( array( 'manage_options' ), $caps );
}
+
+ /**
+ * @dataProvider data_meta_caps_throw_doing_it_wrong_without_required_argument_provided
+ * @ticket 44591
+ *
+ * @param string $cap The meta capability requiring an argument.
+ */
+ public function test_meta_caps_throw_doing_it_wrong_without_required_argument_provided( $cap ) {
+ $admin_user = self::$user_id;
+ $this->setExpectedIncorrectUsage( 'map_meta_cap' );
+ $this->assertContains( 'do_not_allow', map_meta_cap( $cap, $admin_user ) );
+ }
+
+ /**
+ * Data provider.
+ *
+ * @return array[] Test parameters {
+ * @type string $cap The meta capability requiring an argument.
+ * }
+ */
+ public function data_meta_caps_throw_doing_it_wrong_without_required_argument_provided() {
+ return array(
+ array( 'delete_post' ),
+ array( 'delete_page' ),
+ array( 'edit_post' ),
+ array( 'edit_page' ),
+ array( 'read_post' ),
+ array( 'read_page' ),
+ array( 'publish_post' ),
+ array( 'edit_post_meta' ),
+ array( 'delete_post_meta' ),
+ array( 'add_post_meta' ),
+ array( 'edit_comment_meta' ),
+ array( 'delete_comment_meta' ),
+ array( 'add_comment_meta' ),
+ array( 'edit_term_meta' ),
+ array( 'delete_term_meta' ),
+ array( 'add_term_meta' ),
+ array( 'edit_user_meta' ),
+ array( 'delete_user_meta' ),
+ array( 'add_user_meta' ),
+ array( 'edit_comment' ),
+ array( 'edit_term' ),
+ array( 'delete_term' ),
+ array( 'assign_term' ),
+ );
+ }
}