Changeset 11806 for sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

Timestamp:

04/28/2022 03:42:10 AM (4 years ago)

Author:

dd32

Message:

Plugins: Release Management: Include Disabled plugins in the Release Management UI, but restrict confirmation to plugin reviewers.

Props ipstenu for the report.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

@@ -37 +37 @@
         // Remove closed plugins.
         $plugins = array_filter( $plugins, function( $plugin ) {
-            return $plugin && 'publish' === $plugin->post_status;
+            return ( $plugin && in_array( $plugin->post_status, array( 'publish', 'disabled' ) ) );
         } );
 
@@ -232 +232 @@
 
             if ( ! $current_user_confirmed && ! $data['confirmed'] ) {
-                if ( self::can_access() ) {
+                if (
+                    self::can_access() &&
+                    current_user_can( 'plugin_manage_releases', $plugin  )
+                ) {
                     $buttons[] = sprintf(
                         '<a href="%s" class="button approve-release button-primary">%s</a>',
@@ -257 +260 @@
 
     static function can_access() {
+        // Plugin reviewers can always access the release management functionality.
+        if ( current_user_can( 'plugin_review' ) ) {
+            return true;
+        }
+
         // Must have an access token..
         if ( ! is_user_logged_in() || empty( $_COOKIE[ self::COOKIE ] ) ) {