Changeset 7109 for trunk/wp-includes/query.php

Timestamp:

02/29/2008 09:49:49 PM (19 years ago)

Author:

ryan

Message:

Add option to check caps when querying a particular post status. fixes #6052

File:

• trunk/wp-includes/query.php (modified) (2 diffs)

trunk/wp-includes/query.php

@@ -1214 +1214 @@
                         $q_status = explode(',', $q['post_status']);
                         $r_status = array();
+                        $p_status = array();
                         if ( in_array( 'draft'  , $q_status ) )
                                 $r_status[] = "post_status = 'draft'";
@@ -1223 +1224 @@
                                 $r_status[] = "post_status = 'inherit'";
                         if ( in_array( 'private', $q_status ) )
-                                $r_status[] = "post_status = 'private'";
+                                $p_status[] = "post_status = 'private'";
                         if ( in_array( 'publish', $q_status ) )
                                 $r_status[] = "post_status = 'publish'";
-                        if ( !empty($r_status) )
-                                $where .= " AND (" . join( ' OR ', $r_status ) . ")";
+
+                        if ( empty($q['perm'] ) || 'readable' != $q['perm'] ) {
+                                $r_status = array_merge($r_status, $p_status);
+                                unset($p_status);
+                        }
+
+                        if ( !empty($r_status) ) {
+                                if ( !empty($q['perm'] ) && 'editable' == $q['perm'] && !current_user_can("edit_others_{$post_type}s") )
+                                        $where .= " AND (post_author = $user_ID " .  "AND (" . join( ' OR ', $r_status ) . "))";
+                                else
+                                        $where .= " AND (" . join( ' OR ', $r_status ) . ")";
+                        }
+                        if ( !empty($p_status) ) {
+                                if ( !empty($q['perm'] ) && 'readable' == $q['perm'] && !current_user_can("read_private_{$post_type}s") )
+                                        $where .= " AND (post_author = $user_ID " .  "AND (" . join( ' OR ', $p_status ) . "))";
+                                else
+                                        $where .= " AND (" . join( ' OR ', $p_status ) . ")";
+                        }
                 } elseif ( !$this->is_singular ) {
                         $where .= " AND (post_status = 'publish'";