diff --git a/wp-admin/customize.php b/wp-admin/customize.php index e45254c74a..0a5350f54c 100644 --- a/wp-admin/customize.php +++ b/wp-admin/customize.php @@ -20,6 +20,31 @@ if ( ! current_user_can( 'customize' ) ) { ); } +/** + * @global WP_Scripts $wp_scripts + * @global WP_Customize_Manager $wp_customize + */ +global $wp_scripts, $wp_customize; + +if ( $wp_customize->changeset_post_id() ) { + if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->edit_post, $wp_customize->changeset_post_id() ) ) { + wp_die( + '
' . __( 'Sorry, you are not allowed to edit this changeset.' ) . '
', + 403 + ); + } + if ( in_array( get_post_status( $wp_customize->changeset_post_id() ), array( 'publish', 'trash' ), true ) ) { + wp_die( + '' . __( 'This changeset has already been published and cannot be further modified.' ) . '
' . + '', + 403 + ); + } +} + + wp_reset_vars( array( 'url', 'return', 'autofocus' ) ); if ( ! empty( $url ) ) { $wp_customize->set_preview_url( wp_unslash( $url ) ); @@ -31,12 +56,6 @@ if ( ! empty( $autofocus ) && is_array( $autofocus ) ) { $wp_customize->set_autofocus( wp_unslash( $autofocus ) ); } -/** - * @global WP_Scripts $wp_scripts - * @global WP_Customize_Manager $wp_customize - */ -global $wp_scripts, $wp_customize; - $registered = $wp_scripts->registered; $wp_scripts = new WP_Scripts; $wp_scripts->registered = $registered; @@ -115,7 +134,11 @@ do_action( 'customize_controls_print_scripts' );