Changeset 9055

Timestamp:

10/02/2008 04:10:54 AM (16 years ago)

Author:

markjaquith

Message:

Do not allow contributors to set the post slug for pending review posts. fixes #7805

Location:

trunk

Files:

• wp-admin/edit-form-advanced.php (modified) (3 diffs)
• wp-includes/post.php (modified) (4 diffs)

trunk/wp-admin/edit-form-advanced.php

@@ -375 +375 @@
 <?php
 }
-add_meta_box('slugdiv', __('Post Slug'), 'post_slug_meta_box', 'post', 'normal', 'core');
+if ( !( 'pending' == $post->post_status && !current_user_can( 'publish_posts' ) ) )
+    add_meta_box('slugdiv', __('Post Slug'), 'post_slug_meta_box', 'post', 'normal', 'core');
 
 $authors = get_editable_user_ids( $current_user->id ); // TODO: ROLE SYSTEM
@@ -482 +483 @@
 <div class="inside">
 <?php $sample_permalink_html = get_sample_permalink_html($post->ID); ?>
+<?php if ( !( 'pending' == $post->post_status && !current_user_can( 'publish_posts' ) ) ) { ?>
     <div id="edit-slug-box">
 <?php if ( ! empty($post->ID) && ! empty($sample_permalink_html) ) :
@@ -487 +489 @@
 endif; ?>
     </div>
+<?php } ?>
 </div>
 </div>

trunk/wp-includes/post.php

@@ -1351 +1351 @@
     }
 
-    // Create a valid post name.  Drafts are allowed to have an empty
+    // Don't allow contributors to set to set the post slug for pending review posts
+    if ( 'pending' == $post_status && !current_user_can( 'publish_posts' ) )
+        $post_name = '';
+
+    // Create a valid post name.  Drafts and pending posts are allowed to have an empty
     // post name.
     if ( empty($post_name) ) {
-        if ( 'draft' != $post_status )
+        if ( !in_array( $post_status, array( 'draft', 'pending' ) ) )
             $post_name = sanitize_title($post_title);
     } else {
@@ -1360 +1364 @@
     }
 
-    // If the post date is empty (due to having been new or a draft) and status is not 'draft', set date to now
+    // If the post date is empty (due to having been new or a draft) and status is not 'draft' or 'pending', set date to now
     if ( empty($post_date) || '0000-00-00 00:00:00' == $post_date )
         $post_date = current_time('mysql');
 
     if ( empty($post_date_gmt) || '0000-00-00 00:00:00' == $post_date_gmt ) {
-        if ( !in_array($post_status, array('draft', 'pending')) )
+        if ( !in_array( $post_status, array( 'draft', 'pending' ) ) )
             $post_date_gmt = get_gmt_from_date($post_date);
         else
@@ -1415 +1419 @@
         $post_password = '';
 
-    if ( 'draft' != $post_status ) {
+    if ( !in_array( $post_status, array( 'draft', 'pending' ) ) ) {
         $post_name_check = $wpdb->get_var($wpdb->prepare("SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type = %s AND ID != %d AND post_parent = %d LIMIT 1", $post_name, $post_type, $post_ID, $post_parent));
 
@@ -1458 +1462 @@
     }
 
-    if ( empty($post_name) && 'draft' != $post_status ) {
+    if ( empty($post_name) && !in_array( $post_status, array( 'draft', 'pending' ) ) ) {
         $post_name = sanitize_title($post_title, $post_ID);
         $wpdb->update( $wpdb->posts, compact( 'post_name' ), $where );