Changeset 11806

Timestamp:

04/28/2022 03:42:10 AM (4 years ago)

Author:

dd32

Message:

Plugins: Release Management: Include Disabled plugins in the Release Management UI, but restrict confirmation to plugin reviewers.

Props ipstenu for the report.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory

Files:

• class-capabilities.php (modified) (1 diff)
• shortcodes/class-release-confirmation.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-capabilities.php

@@ -64 +64 @@
                     'plugin_self_transfer',
                     'plugin_self_close',
-                    'plugin_manage_releases',
                 )
             )
         ) {
             $required_caps[] = 'do_not_allow';
+        }
+
+        // Disable (or restrict to reviewers) release management.
+        if ( 'plugin_manage_releases' === $cap ) {
+            if ( 'disabled' === $post->post_status ) {
+                // Plugin reviewers can approve for disabled plugins.
+                $required_caps[] = 'plugin_review';
+            } elseif ( 'publish' !== $post->post_status ) {
+                // A non-published plugin cannot have it's releases approved.
+                $required_caps[] = 'do_not_allow';
+            }
         }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

@@ -37 +37 @@
         // Remove closed plugins.
         $plugins = array_filter( $plugins, function( $plugin ) {
-            return $plugin && 'publish' === $plugin->post_status;
+            return ( $plugin && in_array( $plugin->post_status, array( 'publish', 'disabled' ) ) );
         } );
 
@@ -232 +232 @@
 
             if ( ! $current_user_confirmed && ! $data['confirmed'] ) {
-                if ( self::can_access() ) {
+                if (
+                    self::can_access() &&
+                    current_user_can( 'plugin_manage_releases', $plugin  )
+                ) {
                     $buttons[] = sprintf(
                         '<a href="%s" class="button approve-release button-primary">%s</a>',
@@ -257 +260 @@
 
     static function can_access() {
+        // Plugin reviewers can always access the release management functionality.
+        if ( current_user_can( 'plugin_review' ) ) {
+            return true;
+        }
+
         // Must have an access token..
         if ( ! is_user_logged_in() || empty( $_COOKIE[ self::COOKIE ] ) ) {