Changeset 14718 for sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/inc/template-tags.php

Timestamp:

03/16/2026 03:53:45 AM (7 months ago)

Author:

dd32

Message:

Plugin Directory: Allow Featured/Beta plugin owners to manage the committers and allow all committers to toggle public preview.

This relaxes a security change introduced with #5654, so adding/removing committers of these plugins now also triggers the plugins team to be CC'd for review.

Closes ​https://github.com/WordPress/wordpress.org/pull/561.
Fixes #8206.

File:

• sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/inc/template-tags.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-plugins-2024/inc/template-tags.php

@@ -266 +266 @@
         $post = get_post();
 
-        // Check if they can access plugin management, but can't add committers.
-        // This means the plugin has limited self-management functionalities, for security.
+        $is_beta     = is_object_in_term( $post->ID, 'plugin_section', 'beta' );
+        $is_featured = is_object_in_term( $post->ID, 'plugin_section', 'featured' );
+
+        // Check if the plugin is in a section with limited self-management, and the user can manage it.
         if (
-                (
-                        current_user_can( 'plugin_admin_edit', $post ) &&
-                        ! current_user_can( 'plugin_add_committer', $post )
-                ) || (
-                        // Show the notice to plugin reviewers when it's limited. See class-capabilities.php.
-                        is_object_in_term( $post->ID, 'plugin_section', array( 'beta', 'featured' ) ) &&
+                ! ( $is_beta || $is_featured ) ||
+                ! (
+                        current_user_can( 'plugin_admin_edit', $post ) ||
                         current_user_can( 'plugin_review' )
                 )
         ) {
-                printf(
-                        '<div class="plugin-notice notice notice-warning notice-alt"><p>%s</p></div>',
-                        sprintf(
-                                __( 'Management of this plugin has been limited for security reasons. Please contact the <a href="mailto:%1$s">plugins team (%1$s)</a> for assistance to add/remove committers, or to perform other actions that are unavailable.', 'wporg-plugins' ),
-                                'plugins@wordpress.org'
-                        )
+                return;
+        }
+
+        $section = $is_beta ? __( 'Beta', 'wporg-plugins' ) : __( 'Featured', 'wporg-plugins' );
+        $is_owner = get_current_user_id() == $post->post_author;
+
+        if ( $is_owner ) {
+                $message = sprintf(
+                        /* translators: 1: section name (Beta/Featured), 2: plugins team email address */
+                        __( 'This plugin is listed in the %1$s section. Some management features have been limited for security reasons. Please contact the <a href="mailto:%2$s">plugins team (%2$s)</a> for assistance with closing or transferring this plugin.', 'wporg-plugins' ),
+                        $section,
+                        'plugins@wordpress.org'
                 );
-        }
+        } else {
+                $owner = get_user_by( 'ID', $post->post_author );
+                $message = sprintf(
+                        /* translators: 1: section name (Beta/Featured), 2: plugin owner display name, 3: plugins team email address */
+                        __( 'This plugin is listed in the %1$s section. Some management features have been limited for security reasons. Only the plugin owner (%2$s) can manage committers. Please contact the <a href="mailto:%3$s">plugins team (%3$s)</a> for assistance with closing or transferring this plugin.', 'wporg-plugins' ),
+                        $section,
+                        esc_html( $owner->display_name ),
+                        'plugins@wordpress.org'
+                );
+        }
+
+        printf(
+                '<div class="plugin-notice notice notice-warning notice-alt"><p>%s</p></div>',
+                $message
+        );
 }