Changeset 9055 for trunk/wp-includes/post.php

Timestamp:

10/02/2008 04:10:54 AM (16 years ago)

Author:

markjaquith

Message:

Do not allow contributors to set the post slug for pending review posts. fixes #7805

File:

• trunk/wp-includes/post.php (modified) (4 diffs)

trunk/wp-includes/post.php

@@ -1351 +1351 @@
     }
 
-    // Create a valid post name.  Drafts are allowed to have an empty
+    // Don't allow contributors to set to set the post slug for pending review posts
+    if ( 'pending' == $post_status && !current_user_can( 'publish_posts' ) )
+        $post_name = '';
+
+    // Create a valid post name.  Drafts and pending posts are allowed to have an empty
     // post name.
     if ( empty($post_name) ) {
-        if ( 'draft' != $post_status )
+        if ( !in_array( $post_status, array( 'draft', 'pending' ) ) )
             $post_name = sanitize_title($post_title);
     } else {
@@ -1360 +1364 @@
     }
 
-    // If the post date is empty (due to having been new or a draft) and status is not 'draft', set date to now
+    // If the post date is empty (due to having been new or a draft) and status is not 'draft' or 'pending', set date to now
     if ( empty($post_date) || '0000-00-00 00:00:00' == $post_date )
         $post_date = current_time('mysql');
 
     if ( empty($post_date_gmt) || '0000-00-00 00:00:00' == $post_date_gmt ) {
-        if ( !in_array($post_status, array('draft', 'pending')) )
+        if ( !in_array( $post_status, array( 'draft', 'pending' ) ) )
             $post_date_gmt = get_gmt_from_date($post_date);
         else
@@ -1415 +1419 @@
         $post_password = '';
 
-    if ( 'draft' != $post_status ) {
+    if ( !in_array( $post_status, array( 'draft', 'pending' ) ) ) {
         $post_name_check = $wpdb->get_var($wpdb->prepare("SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type = %s AND ID != %d AND post_parent = %d LIMIT 1", $post_name, $post_type, $post_ID, $post_parent));
 
@@ -1458 +1462 @@
     }
 
-    if ( empty($post_name) && 'draft' != $post_status ) {
+    if ( empty($post_name) && !in_array( $post_status, array( 'draft', 'pending' ) ) ) {
         $post_name = sanitize_title($post_title, $post_ID);
         $wpdb->update( $wpdb->posts, compact( 'post_name' ), $where );