Changeset 12164

Timestamp:

10/31/2022 04:26:54 AM (2 years ago)

Author:

dd32

Message:

Plugin Directory: Prevent removing the owner of a plugin as a committer.

Plugin Admins (ie. the plugin review team) can still remove a committer, even if they are the owner of a plugin.

Fixes #5948.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-committers.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-committers.php

@@ -139 +139 @@
 
         $plugin_slug = $request['plugin_slug'];
+        $plugin_post = Plugin_Directory::get_plugin_post( $plugin_slug );
 
         // Prevent a committer removing themselves, if they're the only committer.
@@ -146 +147 @@
                 return new WP_Error( 'failed', __( 'Sorry, you must have at least one committer.', 'wporg-plugins' ) );
             }
+        }
+
+        // Prevent a non-admin removing a committer who is the owner of the plugin.
+        if ( ! current_user_can( 'plugin_approve' ) && $user->ID == $plugin_post->post_author ) {
+            return new WP_Error( 'failed', __( 'Sorry, you cannot remove the owner of the plugin as a committer.', 'wporg-plugins' ) );
         }