From 8a6a7d323eccf2d108c9af95a343a6d9581289de Mon Sep 17 00:00:00 2001 From: Gary Pendergast Date: Thu, 23 Jul 2015 04:27:09 +0000 Subject: [PATCH] Capabilities: When creating an auto-draft, ensure that the current user still has permission to do so. Partial merge of [33357] to the 3.7 branch. Built from https://develop.svn.wordpress.org/branches/3.7@33379 git-svn-id: http://core.svn.wordpress.org/branches/3.7@33350 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/includes/dashboard.php | 4 ++++ wp-includes/capabilities.php | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/wp-admin/includes/dashboard.php b/wp-admin/includes/dashboard.php index d92c4b37a8..6955b54241 100644 --- a/wp-admin/includes/dashboard.php +++ b/wp-admin/includes/dashboard.php @@ -488,6 +488,10 @@ function wp_dashboard_quick_press() { $_REQUEST = array(); // hack for get_default_post_to_edit() } + if ( ! current_user_can( 'edit_posts' ) ) { + return; + } + /* Check if a new auto-draft (= no new post_ID) is needed or if the old can be used */ $last_post_id = (int) get_user_option( 'dashboard_quick_press_last_post_id' ); // Get the last post_ID if ( $last_post_id ) { diff --git a/wp-includes/capabilities.php b/wp-includes/capabilities.php index 91f0a6ac7a..788e79d0e1 100644 --- a/wp-includes/capabilities.php +++ b/wp-includes/capabilities.php @@ -1073,8 +1073,10 @@ function map_meta_cap( $cap, $user_id ) { case 'edit_post': case 'edit_page': $post = get_post( $args[0] ); - if ( empty( $post ) ) + if ( empty( $post ) ) { + $caps[] = 'do_not_allow'; break; + } if ( 'revision' == $post->post_type ) { $post = get_post( $post->post_parent );