Changeset 2996 for sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-status-transitions.php

Timestamp:

04/21/2016 10:01:04 PM (10 years ago)

Author:

obenland

Message:

Plugin Directory: Make sure post_status changes are kosher.

Adds a cap check to make sure everyone can only set plugins to the status they
are supposed to:

• Plugin Admins: Any post status.
• Plugin Reviewers: Draft and Pending.
• Everyone else: No changes allowed.

See #1570.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-status-transitions.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-status-transitions.php

@@ -27 +27 @@
         add_action( 'publish_plugin', array( $this, 'publish' ), 10, 2 );
         add_action( 'rejected_plugin', array( $this, 'rejected' ), 10, 2 );
+    }
+
+    /**
+     * Checks permissions before allowing a post_status change for plugins.
+     *
+     * @param array $data    An array of slashed post data.
+     * @param array $postarr An array of sanitized, but otherwise unmodified post data.
+     * @return array
+     */
+    public static function can_change_post_status( $data, $postarr ) {
+        $old_status = get_post_field( 'post_status', $postarr['ID'] );
+
+        // Keep going if this is not a plugin...
+        if ( 'plugin' !== $postarr['post_type'] ) {
+            return $data;
+        }
+
+        // ...or the status never changed...
+        if ( $old_status === $postarr['post_status'] ) {
+            return $data;
+        }
+
+        // ...or it's a plugin admin...
+        if ( current_user_can( 'plugin_approve', $postarr['ID'] ) ) {
+            return $data;
+        }
+
+        // ...or it's a white-listed status for plugin reviewers.
+        if ( current_user_can( 'plugin_review', $postarr['ID'] ) && in_array( $postarr['post_status'], array( 'draft', 'pending' ) ) ) {
+            return $data;
+        }
+
+        // ...DIE!!!!!
+        wp_die( __( 'You do not have permission to assign this post status to a plugin.', 'wporg-plugins' ), '', array(
+            'back_link' => true,
+        ) );
     }