Changeset 5294

Timestamp:

04/09/2017 06:00:28 AM (8 years ago)

Author:

SergeyBiryukov

Message:

Support Forums: Use post-specific moderate capability checks in Moderators::archive_handler() and ::get_archive_link().

See #2590.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-moderators.php (modified) (4 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-moderators.php

@@ -152 +152 @@
 
     public function archive_handler( $action = '' ) {
-        if ( ! current_user_can( 'moderate' ) ) {
-            return;
-        }
-        $user_id = get_current_user_id();
-
         if ( ! in_array( $action, $this->get_valid_actions() ) ) {
             return;
@@ -165 +160 @@
         }
 
-        $post = get_post( absint( $_GET['post_id'] ) );
-        if ( ! $post ) {
-            return false;
+        $user_id = get_current_user_id();
+        $post_id = absint( $_GET['post_id'] );
+
+        $post = get_post( $post_id );
+        if ( ! $post ) {
+            return;
+        }
+
+        if ( ! current_user_can( 'moderate', $post->ID ) ) {
+            return;
         }
 
@@ -229 +231 @@
 
     public function get_archive_link( $args = array() ) {
-        if ( ! current_user_can( 'moderate' ) ) {
-            return false;
-        }
-        $user_id = get_current_user_id();
-
         $r = bbp_parse_args( $args, array(
             'post_id' => get_the_ID(),
@@ -239 +236 @@
             'unarchive' => esc_html__( 'Unarchive', 'wporg-forums' ),
         ), 'get_post_archive_link' );
+
         if ( empty( $r['post_id'] ) ) {
             return false;
         }
+
+        $user_id = get_current_user_id();
         $post_id = $r['post_id'];
 
         $post = get_post( $post_id );
         if ( ! $post ) {
+            return false;
+        }
+
+        if ( ! current_user_can( 'moderate', $post->ID ) ) {
             return false;
         }