Changeset 7109

Timestamp:

02/29/2008 09:49:49 PM (18 years ago)

Author:

ryan

Message:

Add option to check caps when querying a particular post status. fixes #6052

Location:

trunk

Files:

• wp-admin/edit.php (modified) (2 diffs)
• wp-admin/includes/post.php (modified) (1 diff)
• wp-includes/classes.php (modified) (1 diff)
• wp-includes/post.php (modified) (1 diff)
• wp-includes/query.php (modified) (2 diffs)

trunk/wp-admin/edit.php

@@ -82 +82 @@
 <?php
 $status_links = array();
-$num_posts = wp_count_posts('post');
+$num_posts = wp_count_posts('post', 'readable');
 foreach ( $post_stati as $status => $label ) {
         $class = '';
@@ -89 +89 @@
                 continue;
 
+        if ( empty($num_posts->$status) )
+                continue;
         if ( $status == $_GET['post_status'] )
                 $class = ' class="current"';

trunk/wp-admin/includes/post.php

@@ -514 +514 @@
 
         $post_status_q = '';
-        if ( isset($q['post_status']) && in_array( $q['post_status'], array_keys($post_stati) ) )
+        if ( isset($q['post_status']) && in_array( $q['post_status'], array_keys($post_stati) ) ) {
                 $post_status_q = '&post_status=' . $q['post_status'];
+                $post_status_q .= '&perm=readable';
+        }
 
         if ( 'pending' === $q['post_status'] ) {

trunk/wp-includes/classes.php

@@ -4 +4 @@
         var $public_query_vars = array('m', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'debug', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'comments_popup', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots');
 
-        var $private_query_vars = array('offset', 'posts_per_page', 'posts_per_archive_page', 'what_to_show', 'showposts', 'nopaging', 'post_type', 'post_status', 'category__in', 'category__not_in', 'category__and', 'tag__in', 'tag__not_in', 'tag__and', 'tag_slug__in', 'tag_slug__and', 'tag_id', 'post_mime_type');
+        var $private_query_vars = array('offset', 'posts_per_page', 'posts_per_archive_page', 'what_to_show', 'showposts', 'nopaging', 'post_type', 'post_status', 'category__in', 'category__not_in', 'category__and', 'tag__in', 'tag__not_in', 'tag__and', 'tag_slug__in', 'tag_slug__and', 'tag_id', 'post_mime_type', 'perm');
         var $extra_query_vars = array();
 

trunk/wp-includes/post.php

@@ -823 +823 @@
  * @return array Number of posts for each status
  */
-function wp_count_posts( $type = 'post' ) {
+function wp_count_posts( $type = 'post', $perm = '' ) {
         global $wpdb;
 
-        $count = $wpdb->get_results( $wpdb->prepare( "SELECT post_status, COUNT( * ) AS num_posts FROM {$wpdb->posts} WHERE post_type = %s GROUP BY post_status", $type ), ARRAY_A );
+        $user = wp_get_current_user();
+
+        $query = "SELECT post_status, COUNT( * ) AS num_posts FROM {$wpdb->posts} WHERE post_type = %s";
+        if ( 'readable' == $perm && is_user_logged_in() ) {
+                if ( !current_user_can("read_private_{$type}s") )
+                        $query .= " AND (post_status != 'private' OR ( post_author = '$user->ID' AND post_status = 'private' ))";
+        }
+        $query .= ' GROUP BY post_status';
+        $count = $wpdb->get_results( $wpdb->prepare( $query, $type ), ARRAY_A );
 
         $stats = array( );

trunk/wp-includes/query.php

@@ -1214 +1214 @@
                         $q_status = explode(',', $q['post_status']);
                         $r_status = array();
+                        $p_status = array();
                         if ( in_array( 'draft'  , $q_status ) )
                                 $r_status[] = "post_status = 'draft'";
@@ -1223 +1224 @@
                                 $r_status[] = "post_status = 'inherit'";
                         if ( in_array( 'private', $q_status ) )
-                                $r_status[] = "post_status = 'private'";
+                                $p_status[] = "post_status = 'private'";
                         if ( in_array( 'publish', $q_status ) )
                                 $r_status[] = "post_status = 'publish'";
-                        if ( !empty($r_status) )
-                                $where .= " AND (" . join( ' OR ', $r_status ) . ")";
+
+                        if ( empty($q['perm'] ) || 'readable' != $q['perm'] ) {
+                                $r_status = array_merge($r_status, $p_status);
+                                unset($p_status);
+                        }
+
+                        if ( !empty($r_status) ) {
+                                if ( !empty($q['perm'] ) && 'editable' == $q['perm'] && !current_user_can("edit_others_{$post_type}s") )
+                                        $where .= " AND (post_author = $user_ID " .  "AND (" . join( ' OR ', $r_status ) . "))";
+                                else
+                                        $where .= " AND (" . join( ' OR ', $r_status ) . ")";
+                        }
+                        if ( !empty($p_status) ) {
+                                if ( !empty($q['perm'] ) && 'readable' == $q['perm'] && !current_user_can("read_private_{$post_type}s") )
+                                        $where .= " AND (post_author = $user_ID " .  "AND (" . join( ' OR ', $p_status ) . "))";
+                                else
+                                        $where .= " AND (" . join( ' OR ', $p_status ) . ")";
+                        }
                 } elseif ( !$this->is_singular ) {
                         $where .= " AND (post_status = 'publish'";