Changeset 2441

Timestamp:

03/14/05 00:48:11 (4 years ago)

Author:

ryan

Message:

Don't let users who cannot publish edit published posts, even their own. Make consistent use of user_can_create_post(). http://mosquito.wordpress.org/view.php?id=1004 Props: MC_incubus

Files:

• trunk/wp-admin/edit-form-advanced.php (modified) (2 diffs)
• trunk/wp-admin/edit-form.php (modified) (1 diff)
• trunk/wp-admin/post.php (modified) (3 diffs)
• trunk/wp-register.php (modified) (1 diff)

trunk/wp-admin/edit-form-advanced.php

@@ -116 +116 @@
-if ('publish' != $post_status || 0 == $post_ID) {
-?>
-1 < $user_level || (1 == $user_level && 2 == get_option('new_users_can_blog')
+user_can_create_post($user_ID
-    <input name="publish" type="submit" id="publish" tabindex="10" value="<?php _e('Publish') ?>" /> 
-<?php endif; ?>
@@ -136 +136 @@
-    <tr>
-        <th scope="row" valign="top"><?php _e('Post Status') ?>:</th>
-1 < $user_level || (1 == $user_level && 2 == get_option('new_users_can_blog')
+user_can_create_post($user_ID
-<label for="post_status_publish" class="selectit"><input id="post_status_publish" name="post_status" type="radio" value="publish" <?php checked($post_status, 'publish'); ?> /> <?php _e('Published') ?></label><br />
-<?php endif; ?>

trunk/wp-admin/edit-form.php

@@ -59 +59 @@
-  <input name="saveasprivate" type="submit" id="saveasprivate" tabindex="10" value="<?php _e('Save as Private') ?>" />
-
-<?php if ( 1 < $user_level || (1 == $user_level && 2 == get_option('new_users_can_blog')
+    <?php if ( user_can_create_post($user_ID
-  <input name="publish" type="submit" id="publish" tabindex="6" style="font-weight: bold;" value="<?php _e('Publish') ?>" /> 
-<?php endif; ?>

trunk/wp-admin/post.php

@@ -62 +62 @@
-        $post_status = 'draft';
-    // Double-check
-&& 2 != get_option('new_users_can_blog') 
+
-        $post_status = 'draft';
-    $comment_status = $_POST['comment_status'];
@@ -230 +230 @@
-        die ( __('You are not allowed to view other users\' private posts.') );
-
+    if ( 'publish' == $post_status && (!user_can_create_post($user_ID)) ) {
+         _e('You are not allowed to edit published posts.');
+         break;
+    }
+
-    if ($post_status == 'static') {
-        $page_template = get_post_meta($post_ID, '_wp_page_template', true);
@@ -306 +311 @@
-    if (isset($_POST['publish'])) $post_status = 'publish';
-    // Double-check
-&& 2 != get_option('new_users_can_blog') 
+
-        $post_status = 'draft';
-

trunk/wp-register.php

@@ -55 +55 @@
-   $user_nicename = sanitize_title($user_nickname);
-    $now = gmdate('Y-m-d H:i:s');
-if (get_settings('new_users_can_blog') >= 1) $user_level = 1
+$user_level = get_settings('new_users_can_blog')
-    $password = substr( md5( uniqid( microtime() ) ), 0, 7);
-