Changeset 2996

Timestamp:

04/21/2016 10:01:04 PM (9 years ago)

Author:

obenland

Message:

Plugin Directory: Make sure post_status changes are kosher.

Adds a cap check to make sure everyone can only set plugins to the status they
are supposed to:

• Plugin Admins: Any post status.
• Plugin Reviewers: Draft and Pending.
• Everyone else: No changes allowed.

See #1570.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory

Files:

• admin/class-status-transitions.php (modified) (1 diff)
• admin/metabox/class-controls.php (modified) (1 diff)
• class-plugin-directory.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-status-transitions.php

@@ -27 +27 @@
         add_action( 'publish_plugin', array( $this, 'publish' ), 10, 2 );
         add_action( 'rejected_plugin', array( $this, 'rejected' ), 10, 2 );
+    }
+
+    /**
+     * Checks permissions before allowing a post_status change for plugins.
+     *
+     * @param array $data    An array of slashed post data.
+     * @param array $postarr An array of sanitized, but otherwise unmodified post data.
+     * @return array
+     */
+    public static function can_change_post_status( $data, $postarr ) {
+        $old_status = get_post_field( 'post_status', $postarr['ID'] );
+
+        // Keep going if this is not a plugin...
+        if ( 'plugin' !== $postarr['post_type'] ) {
+            return $data;
+        }
+
+        // ...or the status never changed...
+        if ( $old_status === $postarr['post_status'] ) {
+            return $data;
+        }
+
+        // ...or it's a plugin admin...
+        if ( current_user_can( 'plugin_approve', $postarr['ID'] ) ) {
+            return $data;
+        }
+
+        // ...or it's a white-listed status for plugin reviewers.
+        if ( current_user_can( 'plugin_review', $postarr['ID'] ) && in_array( $postarr['post_status'], array( 'draft', 'pending' ) ) ) {
+            return $data;
+        }
+
+        // ...DIE!!!!!
+        wp_die( __( 'You do not have permission to assign this post status to a plugin.', 'wporg-plugins' ), '', array(
+            'back_link' => true,
+        ) );
     }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-controls.php

@@ -43 +43 @@
         $statuses = array( 'draft', 'pending' );
         if ( current_user_can( 'plugin_approve', $post ) ) {
-            $statuses = array_merge( $statuses, array( 'publish', 'disabled', 'closed', 'rejected' ) );
+            if ( in_array( $post->post_status, array( 'draft', 'pending', 'rejected' ) ) ) {
+                $statuses = array_merge( $statuses, array( 'publish', 'rejected' ) );
+            } else {
+                $statuses = array( 'publish', 'disabled', 'closed' );
+            }
         }
         ?>

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php

@@ -42 +42 @@
             Customizations::instance();
 
+            add_action( 'wp_insert_post_data', array( __NAMESPACE__ . '\Admin\Status_Transitions', 'can_change_post_status' ), 10, 2 );
             add_action( 'transition_post_status', array( __NAMESPACE__ . '\Admin\Status_Transitions', 'instance' ) );
         }