IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Introduce register_meta(), get_metadata_by_mid(), and *_post_meta capabilities. fixes #17850

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@18445 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan
2011-07-20 22:04:35 +00:00
parent 8d7a97abf9
commit 4ad0954961
8 changed files with 118 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
wp-admin/admin-ajax.php
View File

@@ -393,10 +393,10 @@ case 'delete-link' :
break;
case 'delete-meta' :
check_ajax_referer( "delete-meta_$id" );
if ( !$meta = get_post_meta_by_id( $id ) )
if ( !$meta = get_metadata_by_mid( 'post', $id ) )
die('1');
if ( !current_user_can( 'edit_post', $meta->post_id ) || is_protected_meta( $meta->meta_key ) )
if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta', $meta->post_id, $meta->meta_key ) )
die('-1');
if ( delete_meta( $meta->meta_id ) )
die('1');
@@ -849,7 +849,7 @@ case 'add-meta' :
die(__('Please provide a custom field value.'));
}
$meta = get_post_meta_by_id( $mid );
$meta = get_metadata_by_mid( 'post', $mid );
$pid = (int) $meta->post_id;
$meta = get_object_vars( $meta );
$x = new WP_Ajax_Response( array(
@@ -869,9 +869,7 @@ case 'add-meta' :
die(__('Please provide a custom field value.'));
if ( !$meta = get_post_meta_by_id( $mid ) )
die('0'); // if meta doesn't exist
if ( !current_user_can( 'edit_post', $meta->post_id ) )
die('-1');
if ( is_protected_meta( $meta->meta_key ) )
if ( is_protected_meta( $meta->meta_key, 'post' ) || !current_user_can( 'edit_post_meta', $meta->post_id, $meta->meta_key ) )
die('-1');
if ( $meta->meta_value != stripslashes($value) || $meta->meta_key != stripslashes($key) ) {
if ( !$u = update_meta( $mid, $key, $value ) )

6
wp-admin/includes/meta-boxes.php
View File

@@ -425,7 +425,11 @@ function post_custom_meta_box($post) {
<div id="ajax-response"></div>
<?php
$metadata = has_meta($post->ID);
list_meta($metadata);
foreach ( $metadata as $key => $value ) {
if ( is_protected_meta( $metadata[ $key ][ 'meta_key' ], 'post' ) || ! current_user_can( 'edit_post_meta', $post->ID, $metadata[ $key ][ 'meta_key' ] ) )
unset( $metadata[ $key ] );
}
list_meta( $metadata );
meta_form(); ?>
</div>
<p><?php _e('Custom fields can be used to add extra metadata to a post that you can <a href="http://codex.wordpress.org/Using_Custom_Fields" target="_blank">use in your theme</a>.'); ?></p>

20
wp-admin/includes/post.php
View File

@@ -210,7 +210,7 @@ function edit_post( $post_data = null ) {
continue;
if ( $meta->post_id != $post_ID )
continue;
if ( is_protected_meta( $value['key'] ) )
if ( is_protected_meta( $value['key'], 'post' ) || ! current_user_can( 'edit_post_meta', $post_ID, $value['key'] ) )
continue;
update_meta( $key, $value['key'], $value['value'] );
}
@@ -222,7 +222,7 @@ function edit_post( $post_data = null ) {
continue;
if ( $meta->post_id != $post_ID )
continue;
if ( is_protected_meta( $meta->meta_key ) )
if ( is_protected_meta( $meta->meta_key, 'post' ) || ! current_user_can( 'delete_post_meta', $post_ID, $meta->meta_key ) )
continue;
delete_meta( $key );
}
@@ -671,7 +671,7 @@ function add_meta( $post_ID ) {
if ( is_string($metavalue) )
$metavalue = trim( $metavalue );
if ( ('0' === $metavalue || !empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
if ( ('0' === $metavalue || ! empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
// We have a key/value pair. If both the select and the
// input for the key have data, the input takes precedence:
@@ -681,16 +681,12 @@ function add_meta( $post_ID ) {
if ( $metakeyinput)
$metakey = $metakeyinput; // default
if ( is_protected_meta( $metakey ) )
if ( is_protected_meta( $metakey, 'post' ) || ! current_user_can( 'add_post_meta', $post_ID, $metakey ) )
return false;
wp_cache_delete($post_ID, 'post_meta');
$wpdb->insert( $wpdb->postmeta, array( 'post_id' => $post_ID, 'meta_key' => $metakey, 'meta_value' => $metavalue ) );
$meta_id = $wpdb->insert_id;
do_action( 'added_postmeta', $meta_id, $post_ID, $metakey, $metavalue );
return $meta_id;
return add_post_meta($post_ID, $metakey, $metavalue);
}
return false;
} // add_meta
@@ -771,7 +767,6 @@ function has_meta( $postid ) {
return $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value, meta_id, post_id
FROM $wpdb->postmeta WHERE post_id = %d
ORDER BY meta_key,meta_id", $postid), ARRAY_A );
}
/**
@@ -789,9 +784,6 @@ function update_meta( $meta_id, $meta_key, $meta_value ) {
$meta_key = stripslashes($meta_key);
if ( is_protected_meta( $meta_key ) )
return false;
if ( '' === trim( $meta_value ) )
return false;

4
wp-admin/includes/template.php
View File

@@ -466,7 +466,7 @@ function list_meta( $meta ) {
function _list_meta_row( $entry, &$count ) {
static $update_nonce = false;
if ( is_protected_meta( $entry['meta_key'] ) )
if ( is_protected_meta( $entry['meta_key'], 'post' ) )
return;
if ( !$update_nonce )
@@ -478,8 +478,6 @@ function _list_meta_row( $entry, &$count ) {
$style = 'alternate';
else
$style = '';
if ('_' == $entry['meta_key'] { 0 } )
$style .= ' hidden';
if ( is_serialized( $entry['meta_value'] ) ) {
if ( is_serialized_string( $entry['meta_value'] ) ) {