From fe5a844be57adecb3f7b74bfcd1d8b8f153eedc4 Mon Sep 17 00:00:00 2001 From: Gary Pendergast Date: Wed, 22 Jul 2015 04:02:25 +0000 Subject: [PATCH] Capabilities: When creating an auto-draft, ensure that the current user still has permission to do so. Built from https://develop.svn.wordpress.org/trunk@33357 git-svn-id: http://core.svn.wordpress.org/trunk@33329 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/includes/dashboard.php | 4 ++++ wp-admin/post.php | 5 +++-- wp-includes/capabilities.php | 4 +++- wp-includes/version.php | 2 +- 4 files changed, 11 insertions(+), 4 deletions(-) diff --git a/wp-admin/includes/dashboard.php b/wp-admin/includes/dashboard.php index 8aae3b7a2b..49fcdd926b 100644 --- a/wp-admin/includes/dashboard.php +++ b/wp-admin/includes/dashboard.php @@ -442,6 +442,10 @@ function wp_network_dashboard_right_now() { function wp_dashboard_quick_press( $error_msg = false ) { global $post_ID; + if ( ! current_user_can( 'edit_posts' ) ) { + return; + } + /* Check if a new auto-draft (= no new post_ID) is needed or if the old can be used */ $last_post_id = (int) get_user_option( 'dashboard_quick_press_last_post_id' ); // Get the last post_ID if ( $last_post_id ) { diff --git a/wp-admin/post.php b/wp-admin/post.php index c049d6a937..08b0232410 100644 --- a/wp-admin/post.php +++ b/wp-admin/post.php @@ -120,8 +120,9 @@ case 'post-quickdraft-save': if ( ! wp_verify_nonce( $nonce, 'add-post' ) ) $error_msg = __( 'Unable to submit this form, please refresh and try again.' ); - if ( ! current_user_can( 'edit_posts' ) ) - $error_msg = __( 'Oops, you don’t have access to add new drafts.' ); + if ( ! current_user_can( 'edit_posts' ) ) { + exit; + } if ( $error_msg ) return wp_dashboard_quick_press( $error_msg ); diff --git a/wp-includes/capabilities.php b/wp-includes/capabilities.php index f5262d9a79..dd97d98098 100644 --- a/wp-includes/capabilities.php +++ b/wp-includes/capabilities.php @@ -1188,8 +1188,10 @@ function map_meta_cap( $cap, $user_id ) { case 'edit_post': case 'edit_page': $post = get_post( $args[0] ); - if ( empty( $post ) ) + if ( empty( $post ) ) { + $caps[] = 'do_not_allow'; break; + } if ( 'revision' == $post->post_type ) { $post = get_post( $post->post_parent ); diff --git a/wp-includes/version.php b/wp-includes/version.php index b6ab473bfa..1d2d92cb18 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.3-beta3-33356'; +$wp_version = '4.3-beta3-33357'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.