Skip to content

Commit 17ef6d8

Browse files
johnbillionjohnbillion
committed
Taxonomy: Introduce more fine grained capabilities for managing taxonomy terms.
This introduces the singular `edit_term`, `delete_term`, and `assign_term` meta capabilities for terms, and switches the base capability name for tags from `manage_categories` to `manage_post_tags` and the corresponding `edit_post_tags`, `delete_post_tags`, and `assign_post_tags`. All of these capabilities ultimately map to `manage_categories` so by default there is no change in the behaviour of the capabilities for categories, tags, or custom taxonomies. The `map_meta_cap` filter and the `capabilities` argument when registering a taxonomy now allow for control over editing, deleting, and assigning individual terms, as well as a separation of capabilities for tags from those of categories. Fixes #35614 Props johnjamesjacoby for feedback git-svn-id: https://develop.svn.wordpress.org/trunk@38698 602fd350-edb4-49c9-b593-d223f7449a82
1 parent ad6ef7c commit 17ef6d8

14 files changed

Lines changed: 173 additions & 46 deletions

‎src/wp-admin/edit-tags.php‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@
108108
$tag_ID = (int) $_REQUEST['tag_ID'];
109109
check_admin_referer( 'delete-tag_' . $tag_ID );
110110

111-
if ( ! current_user_can( $tax->cap->delete_terms ) ) {
111+
if ( ! current_user_can( 'delete_term', $tag_ID ) ) {
112112
wp_die(
113113
'<h1>' . __( 'Cheatin&#8217; uh?' ) . '</h1>' .
114114
'<p>' . __( 'Sorry, you are not allowed to delete this item.' ) . '</p>',
@@ -168,7 +168,7 @@
168168
$tag_ID = (int) $_POST['tag_ID'];
169169
check_admin_referer( 'update-tag_' . $tag_ID );
170170

171-
if ( ! current_user_can( $tax->cap->edit_terms ) ) {
171+
if ( ! current_user_can( 'edit_term', $tag_ID ) ) {
172172
wp_die(
173173
'<h1>' . __( 'Cheatin&#8217; uh?' ) . '</h1>' .
174174
'<p>' . __( 'Sorry, you are not allowed to edit this item.' ) . '</p>',
@@ -314,14 +314,6 @@
314314

315315
require_once( ABSPATH . 'wp-admin/admin-header.php' );
316316

317-
if ( ! current_user_can( $tax->cap->edit_terms ) ) {
318-
wp_die(
319-
'<h1>' . __( 'Cheatin&#8217; uh?' ) . '</h1>' .
320-
'<p>' . __( 'Sorry, you are not allowed to edit this item.' ) . '</p>',
321-
403
322-
);
323-
}
324-
325317
/** Also used by the Edit Tag form */
326318
require_once( ABSPATH . 'wp-admin/includes/edit-tag-messages.php' );
327319

‎src/wp-admin/includes/ajax-actions.php‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -594,12 +594,11 @@ function wp_ajax_delete_tag() {
594594
$tag_id = (int) $_POST['tag_ID'];
595595
check_ajax_referer( "delete-tag_$tag_id" );
596596

597-
$taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';
598-
$tax = get_taxonomy($taxonomy);
599-
600-
if ( !current_user_can( $tax->cap->delete_terms ) )
597+
if ( ! current_user_can( 'delete_term', $tag_id ) ) {
601598
wp_die( -1 );
599+
}
602600

601+
$taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';
603602
$tag = get_term( $tag_id, $taxonomy );
604603
if ( !$tag || is_wp_error( $tag ) )
605604
wp_die( 1 );
@@ -796,8 +795,10 @@ function wp_ajax_add_link_category( $action ) {
796795
if ( empty( $action ) )
797796
$action = 'add-link-category';
798797
check_ajax_referer( $action );
799-
if ( !current_user_can( 'manage_categories' ) )
798+
$tax = get_taxonomy( 'link_category' );
799+
if ( ! current_user_can( $tax->cap->manage_terms ) ) {
800800
wp_die( -1 );
801+
}
801802
$names = explode(',', wp_unslash( $_POST['newcat'] ) );
802803
$x = new WP_Ajax_Response();
803804
foreach ( $names as $cat_name ) {
@@ -1703,13 +1704,15 @@ function wp_ajax_inline_save_tax() {
17031704
if ( ! $tax )
17041705
wp_die( 0 );
17051706

1706-
if ( ! current_user_can( $tax->cap->edit_terms ) )
1707+
if ( ! isset( $_POST['tax_ID'] ) || ! ( $id = (int) $_POST['tax_ID'] ) ) {
17071708
wp_die( -1 );
1709+
}
17081710

1709-
$wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
1710-
1711-
if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) )
1711+
if ( ! current_user_can( 'edit_term', $id ) ) {
17121712
wp_die( -1 );
1713+
}
1714+
1715+
$wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
17131716

17141717
$tag = get_term( $id, $taxonomy );
17151718
$_POST['description'] = $tag->description;

‎src/wp-admin/includes/class-wp-terms-list-table.php‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,10 @@ public function no_items() {
151151
*/
152152
protected function get_bulk_actions() {
153153
$actions = array();
154-
$actions['delete'] = __( 'Delete' );
154+
155+
if ( current_user_can( get_taxonomy( $this->screen->taxonomy )->cap->delete_terms ) ) {
156+
$actions['delete'] = __( 'Delete' );
157+
}
155158

156159
return $actions;
157160
}
@@ -332,11 +335,10 @@ public function single_row( $tag, $level = 0 ) {
332335
* @return string
333336
*/
334337
public function column_cb( $tag ) {
335-
$default_term = get_option( 'default_' . $this->screen->taxonomy );
336-
337-
if ( current_user_can( get_taxonomy( $this->screen->taxonomy )->cap->delete_terms ) && $tag->term_id != $default_term )
338+
if ( current_user_can( 'delete_term', $tag->term_id ) ) {
338339
return '<label class="screen-reader-text" for="cb-select-' . $tag->term_id . '">' . sprintf( __( 'Select %s' ), $tag->name ) . '</label>'
339340
. '<input type="checkbox" name="delete_tags[]" value="' . $tag->term_id . '" id="cb-select-' . $tag->term_id . '" />';
341+
}
340342

341343
return '&nbsp;';
342344
}
@@ -423,8 +425,6 @@ protected function handle_row_actions( $tag, $column_name, $primary ) {
423425

424426
$taxonomy = $this->screen->taxonomy;
425427
$tax = get_taxonomy( $taxonomy );
426-
$default_term = get_option( 'default_' . $taxonomy );
427-
428428
$uri = wp_doing_ajax() ? wp_get_referer() : $_SERVER['REQUEST_URI'];
429429

430430
$edit_link = add_query_arg(
@@ -434,7 +434,7 @@ protected function handle_row_actions( $tag, $column_name, $primary ) {
434434
);
435435

436436
$actions = array();
437-
if ( current_user_can( $tax->cap->edit_terms ) ) {
437+
if ( current_user_can( 'edit_term', $tag->term_id ) ) {
438438
$actions['edit'] = sprintf(
439439
'<a href="%s" aria-label="%s">%s</a>',
440440
esc_url( $edit_link ),
@@ -449,7 +449,7 @@ protected function handle_row_actions( $tag, $column_name, $primary ) {
449449
__( 'Quick&nbsp;Edit' )
450450
);
451451
}
452-
if ( current_user_can( $tax->cap->delete_terms ) && $tag->term_id != $default_term ) {
452+
if ( current_user_can( 'delete_term', $tag->term_id ) ) {
453453
$actions['delete'] = sprintf(
454454
'<a href="%s" class="delete-tag aria-button-if-js" aria-label="%s">%s</a>',
455455
wp_nonce_url( "edit-tags.php?action=delete&amp;taxonomy=$taxonomy&amp;tag_ID=$tag->term_id", 'delete-tag_' . $tag->term_id ),

‎src/wp-admin/includes/meta-boxes.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -434,6 +434,8 @@ function post_tags_meta_box( $post, $box ) {
434434
<input type="button" class="button tagadd" value="<?php esc_attr_e('Add'); ?>" /></p>
435435
</div>
436436
<p class="howto" id="new-tag-<?php echo $tax_name; ?>-desc"><?php echo $taxonomy->labels->separate_items_with_commas; ?></p>
437+
<?php elseif ( empty( $terms_to_edit ) ): ?>
438+
<p><?php echo $taxonomy->labels->no_terms; ?></p>
437439
<?php endif; ?>
438440
</div>
439441
<div class="tagchecklist"></div>

‎src/wp-admin/term.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@
3131
$title = $tax->labels->edit_item;
3232

3333
if ( ! in_array( $taxonomy, get_taxonomies( array( 'show_ui' => true ) ) ) ||
34-
! current_user_can( $tax->cap->manage_terms )
34+
! current_user_can( 'edit_term', $tag->term_id )
3535
) {
3636
wp_die(
3737
'<h1>' . __( 'Cheatin&#8217; uh?' ) . '</h1>' .
38-
'<p>' . __( 'Sorry, you are not allowed to manage this item.' ) . '</p>',
38+
'<p>' . __( 'Sorry, you are not allowed to edit this item.' ) . '</p>',
3939
403
4040
);
4141
}

‎src/wp-includes/admin-bar.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -635,7 +635,7 @@ function wp_admin_bar_edit_menu( $wp_admin_bar ) {
635635
) );
636636
} elseif ( ! empty( $current_object->taxonomy )
637637
&& ( $tax = get_taxonomy( $current_object->taxonomy ) )
638-
&& current_user_can( $tax->cap->edit_terms )
638+
&& current_user_can( 'edit_term', $current_object->term_id )
639639
&& $edit_term_link = get_edit_term_link( $current_object->term_id, $current_object->taxonomy ) )
640640
{
641641
$wp_admin_bar->add_menu( array(

‎src/wp-includes/capabilities.php‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,43 @@ function map_meta_cap( $cap, $user_id ) {
402402
case 'delete_site':
403403
$caps[] = 'manage_options';
404404
break;
405+
case 'edit_term':
406+
case 'delete_term':
407+
case 'assign_term':
408+
$term_id = $args[0];
409+
$term = get_term( $term_id );
410+
if ( ! $term || is_wp_error( $term ) ) {
411+
$caps[] = 'do_not_allow';
412+
break;
413+
}
414+
415+
$tax = get_taxonomy( $term->taxonomy );
416+
if ( ! $tax ) {
417+
$caps[] = 'do_not_allow';
418+
break;
419+
}
420+
421+
if ( 'delete_term' === $cap && ( $term->term_id == get_option( 'default_' . $term->taxonomy ) ) ) {
422+
$caps[] = 'do_not_allow';
423+
break;
424+
}
425+
426+
$taxo_cap = $cap . 's';
427+
428+
$caps = map_meta_cap( $tax->cap->$taxo_cap, $user_id, $term_id );
429+
430+
break;
431+
case 'manage_post_tags':
432+
case 'edit_categories':
433+
case 'edit_post_tags':
434+
case 'delete_categories':
435+
case 'delete_post_tags':
436+
$caps[] = 'manage_categories';
437+
break;
438+
case 'assign_categories':
439+
case 'assign_post_tags':
440+
$caps[] = 'edit_posts';
441+
break;
405442
case 'create_sites':
406443
case 'delete_sites':
407444
case 'manage_network':

‎src/wp-includes/class-wp-xmlrpc-server.php‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1886,8 +1886,9 @@ public function wp_newTerm( $args ) {
18861886

18871887
$taxonomy = get_taxonomy( $content_struct['taxonomy'] );
18881888

1889-
if ( ! current_user_can( $taxonomy->cap->manage_terms ) )
1889+
if ( ! current_user_can( $taxonomy->cap->edit_terms ) ) {
18901890
return new IXR_Error( 401, __( 'Sorry, you are not allowed to create terms in this taxonomy.' ) );
1891+
}
18911892

18921893
$taxonomy = (array) $taxonomy;
18931894

@@ -1973,9 +1974,6 @@ public function wp_editTerm( $args ) {
19731974

19741975
$taxonomy = get_taxonomy( $content_struct['taxonomy'] );
19751976

1976-
if ( ! current_user_can( $taxonomy->cap->edit_terms ) )
1977-
return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit terms in this taxonomy.' ) );
1978-
19791977
$taxonomy = (array) $taxonomy;
19801978

19811979
// hold the data of the term
@@ -1989,6 +1987,10 @@ public function wp_editTerm( $args ) {
19891987
if ( ! $term )
19901988
return new IXR_Error( 404, __( 'Invalid term ID.' ) );
19911989

1990+
if ( ! current_user_can( 'edit_term', $term_id ) ) {
1991+
return new IXR_Error( 401, __( 'Sorry, you are not allowed to edit this term.' ) );
1992+
}
1993+
19921994
if ( isset( $content_struct['name'] ) ) {
19931995
$term_data['name'] = trim( $content_struct['name'] );
19941996

@@ -2068,10 +2070,6 @@ public function wp_deleteTerm( $args ) {
20682070
return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
20692071

20702072
$taxonomy = get_taxonomy( $taxonomy );
2071-
2072-
if ( ! current_user_can( $taxonomy->cap->delete_terms ) )
2073-
return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete terms in this taxonomy.' ) );
2074-
20752073
$term = get_term( $term_id, $taxonomy->name );
20762074

20772075
if ( is_wp_error( $term ) )
@@ -2080,6 +2078,10 @@ public function wp_deleteTerm( $args ) {
20802078
if ( ! $term )
20812079
return new IXR_Error( 404, __( 'Invalid term ID.' ) );
20822080

2081+
if ( ! current_user_can( 'delete_term', $term_id ) ) {
2082+
return new IXR_Error( 401, __( 'Sorry, you are not allowed to delete this term.' ) );
2083+
}
2084+
20832085
$result = wp_delete_term( $term_id, $taxonomy->name );
20842086

20852087
if ( is_wp_error( $result ) )
@@ -2140,9 +2142,6 @@ public function wp_getTerm( $args ) {
21402142

21412143
$taxonomy = get_taxonomy( $taxonomy );
21422144

2143-
if ( ! current_user_can( $taxonomy->cap->assign_terms ) )
2144-
return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign terms in this taxonomy.' ) );
2145-
21462145
$term = get_term( $term_id , $taxonomy->name, ARRAY_A );
21472146

21482147
if ( is_wp_error( $term ) )
@@ -2151,6 +2150,10 @@ public function wp_getTerm( $args ) {
21512150
if ( ! $term )
21522151
return new IXR_Error( 404, __( 'Invalid term ID.' ) );
21532152

2153+
if ( ! current_user_can( 'assign_term', $term_id ) ) {
2154+
return new IXR_Error( 401, __( 'Sorry, you are not allowed to assign this term.' ) );
2155+
}
2156+
21542157
return $this->_prepare_term( $term );
21552158
}
21562159

‎src/wp-includes/link-template.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -930,7 +930,7 @@ function get_edit_term_link( $term_id, $taxonomy = '', $object_type = '' ) {
930930
}
931931

932932
$tax = get_taxonomy( $term->taxonomy );
933-
if ( ! $tax || ! current_user_can( $tax->cap->edit_terms ) ) {
933+
if ( ! $tax || ! current_user_can( 'edit_term', $term->term_id ) ) {
934934
return;
935935
}
936936

@@ -984,7 +984,7 @@ function edit_term_link( $link = '', $before = '', $after = '', $term = null, $e
984984
return;
985985

986986
$tax = get_taxonomy( $term->taxonomy );
987-
if ( ! current_user_can( $tax->cap->edit_terms ) ) {
987+
if ( ! current_user_can( 'edit_term', $term->term_id ) ) {
988988
return;
989989
}
990990

‎src/wp-includes/taxonomy.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,12 @@ function create_initial_taxonomies() {
6161
'show_ui' => true,
6262
'show_admin_column' => true,
6363
'_builtin' => true,
64+
'capabilities' => array(
65+
'manage_terms' => 'manage_categories',
66+
'edit_terms' => 'edit_categories',
67+
'delete_terms' => 'delete_categories',
68+
'assign_terms' => 'assign_categories',
69+
),
6470
) );
6571

6672
register_taxonomy( 'post_tag', 'post', array(
@@ -71,6 +77,12 @@ function create_initial_taxonomies() {
7177
'show_ui' => true,
7278
'show_admin_column' => true,
7379
'_builtin' => true,
80+
'capabilities' => array(
81+
'manage_terms' => 'manage_post_tags',
82+
'edit_terms' => 'edit_post_tags',
83+
'delete_terms' => 'delete_post_tags',
84+
'assign_terms' => 'assign_post_tags',
85+
),
7486
) );
7587

7688
register_taxonomy( 'nav_menu', 'nav_menu_item', array(

0 commit comments

Comments
 (0)