Changeset 11806

Timestamp:

04/28/2022 03:42:10 AM (4 years ago)

Author:

dd32

Message:

Plugins: Release Management: Include Disabled plugins in the Release Management UI, but restrict confirmation to plugin reviewers.

Props ipstenu for the report.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory

Files:

• class-capabilities.php (modified) (1 diff)
• shortcodes/class-release-confirmation.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-capabilities.php

@@ -64 +64 @@
                                         'plugin_self_transfer',
                                         'plugin_self_close',
-                                        'plugin_manage_releases',
                                 )
                         )
                 ) {
                         $required_caps[] = 'do_not_allow';
+                }
+
+                // Disable (or restrict to reviewers) release management.
+                if ( 'plugin_manage_releases' === $cap ) {
+                        if ( 'disabled' === $post->post_status ) {
+                                // Plugin reviewers can approve for disabled plugins.
+                                $required_caps[] = 'plugin_review';
+                        } elseif ( 'publish' !== $post->post_status ) {
+                                // A non-published plugin cannot have it's releases approved.
+                                $required_caps[] = 'do_not_allow';
+                        }
                 }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

@@ -37 +37 @@
                 // Remove closed plugins.
                 $plugins = array_filter( $plugins, function( $plugin ) {
-                        return $plugin && 'publish' === $plugin->post_status;
+                        return ( $plugin && in_array( $plugin->post_status, array( 'publish', 'disabled' ) ) );
                 } );
 
@@ -232 +232 @@
 
                         if ( ! $current_user_confirmed && ! $data['confirmed'] ) {
-                                if ( self::can_access() ) {
+                                if (
+                                        self::can_access() &&
+                                        current_user_can( 'plugin_manage_releases', $plugin  )
+                                ) {
                                         $buttons[] = sprintf(
                                                 '<a href="%s" class="button approve-release button-primary">%s</a>',
@@ -257 +260 @@
 
         static function can_access() {
+                // Plugin reviewers can always access the release management functionality.
+                if ( current_user_can( 'plugin_review' ) ) {
+                        return true;
+                }
+
                 // Must have an access token..
                 if ( ! is_user_logged_in() || empty( $_COOKIE[ self::COOKIE ] ) ) {