_wp_translate_postdata() should use current_user_can( $ptype->cap->edit_post, $post_id )

[danielbachhuber]

Similar to #22415, _wp_translate_postdata() should use current_user_can( $ptype->cap->edit_post, $post_id ) here:

$ptype = get_post_type_object( $post_data['post_type'] );
	if ( isset($post_data['user_ID']) && ($post_data['post_author'] != $post_data['user_ID']) ) {
		if ( !current_user_can( $ptype->cap->edit_others_posts ) ) {

I think this is problematic too:

if ( $previous_status != 'publish' || !current_user_can( 'edit_post', $post_id ) )
			$post_data['post_status'] = 'pending';

Switching to current_user_can( $ptype->cap->edit_post, $post_id ) would mean that the context could be appropriately filtered.

[nacin]

I imagine this is in place for _wp_translate_postdata( false ), as in — when it is not used for an update.

wp_write_post() uses this, but this code is actually dead now and has been since auto-drafts are introduced, because edit_post() gets called right before it. For more on removing wp_write_post() and making this code more sane, see #21963.

If $update, we should be able to make the more informed capability checks you are proposing.

[westi]

Started some basic tests for this code in ​[UT1147]

[westi]

@danielbachhuber it would be really useful if you could help write some tests which show the issues you are having to add to the above tests.

[westi]

Patch to make the first cap check post_ID aware

[westi]

That patch shows that my tests are broken too, need to update them to create real posts for the update = true tests ;)

[westi]

Tests fixed in ​[UT1150]

[westi]

In 22769:

Posting: Improve the capability checking _wp_translate_postdata() when updating posts.

• Use the specific post_type's 'edit_post' cap
• Pass the ID of the post being edited.

Fixes #22417

[nacin]

Chatted about this with westi in IRC. A few points:

• The second part of this bug report can be answered by (and further addressed in) #22415.

• [22769] looks good, but after it landed, I noticed that 'edit_post' could get away with being outside of the post_author == user_ID block, instead letting the meta capability handle that part. Of course, that check may still be necessary for $update = false (which I'll aim to eliminate in 3.6). So, re-opening for review.

[nacin]

Back to westi.

[ryan]

In 22950:

Add a create_posts check to _wp_translate_postdata(). Move the edit_post check to the top of the function.

Props nacin
fixes #22417