Changeset 5294 for sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-moderators.php

Timestamp:

04/09/2017 06:00:28 AM (9 years ago)

Author:

SergeyBiryukov

Message:

Support Forums: Use post-specific moderate capability checks in Moderators::archive_handler() and ::get_archive_link().

See #2590.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-moderators.php (modified) (4 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-moderators.php

@@ -152 +152 @@
 
         public function archive_handler( $action = '' ) {
-                if ( ! current_user_can( 'moderate' ) ) {
-                        return;
-                }
-                $user_id = get_current_user_id();
-
                 if ( ! in_array( $action, $this->get_valid_actions() ) ) {
                         return;
@@ -165 +160 @@
                 }
 
-                $post = get_post( absint( $_GET['post_id'] ) );
-                if ( ! $post ) {
-                        return false;
+                $user_id = get_current_user_id();
+                $post_id = absint( $_GET['post_id'] );
+
+                $post = get_post( $post_id );
+                if ( ! $post ) {
+                        return;
+                }
+
+                if ( ! current_user_can( 'moderate', $post->ID ) ) {
+                        return;
                 }
 
@@ -229 +231 @@
 
         public function get_archive_link( $args = array() ) {
-                if ( ! current_user_can( 'moderate' ) ) {
-                        return false;
-                }
-                $user_id = get_current_user_id();
-
                 $r = bbp_parse_args( $args, array(
                         'post_id' => get_the_ID(),
@@ -239 +236 @@
                         'unarchive' => esc_html__( 'Unarchive', 'wporg-forums' ),
                 ), 'get_post_archive_link' );
+
                 if ( empty( $r['post_id'] ) ) {
                         return false;
                 }
+
+                $user_id = get_current_user_id();
                 $post_id = $r['post_id'];
 
                 $post = get_post( $post_id );
                 if ( ! $post ) {
+                        return false;
+                }
+
+                if ( ! current_user_can( 'moderate', $post->ID ) ) {
                         return false;
                 }