Skip to content

Commit 34df3b0

Browse files
leonidasmileonidasmi
authored
Merge pull request #452 from Yoast/fix/permission-check
Improves permissions checks for the Bulk Clone action and the republishing of a copy.
2 parents ba095f6 + 20f0fd7 commit 34df3b0

File tree

6 files changed

+578
-16
lines changed

6 files changed

+578
-16
lines changed

‎src/handlers/bulk-handler.php‎

Lines changed: 37 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -89,18 +89,28 @@ public function rewrite_bulk_action_handler( $redirect_to, $doaction, $post_ids
8989
}
9090

9191
$counter = 0;
92+
$skipped = 0;
9293
if ( \is_array( $post_ids ) ) {
9394
foreach ( $post_ids as $post_id ) {
9495
$post = \get_post( $post_id );
95-
if ( ! empty( $post ) && $this->permissions_helper->should_rewrite_and_republish_be_allowed( $post ) ) {
96-
$new_post_id = $this->post_duplicator->create_duplicate_for_rewrite_and_republish( $post );
97-
if ( ! \is_wp_error( $new_post_id ) ) {
98-
++$counter;
99-
}
96+
if ( empty( $post ) || ! $this->permissions_helper->should_rewrite_and_republish_be_allowed( $post ) ) {
97+
continue;
98+
}
99+
if ( ! \current_user_can( 'edit_post', $post_id ) ) {
100+
++$skipped;
101+
continue;
102+
}
103+
$new_post_id = $this->post_duplicator->create_duplicate_for_rewrite_and_republish( $post );
104+
if ( ! \is_wp_error( $new_post_id ) ) {
105+
++$counter;
100106
}
101107
}
102108
}
103-
return \add_query_arg( 'bulk_rewriting', $counter, $redirect_to );
109+
$redirect_to = \add_query_arg( 'bulk_rewriting', $counter, $redirect_to );
110+
if ( $skipped > 0 ) {
111+
$redirect_to = \add_query_arg( 'bulk_rewriting_skipped', $skipped, $redirect_to );
112+
}
113+
return $redirect_to;
104114
}
105115

106116
/**
@@ -118,21 +128,32 @@ public function clone_bulk_action_handler( $redirect_to, $doaction, $post_ids )
118128
}
119129

120130
$counter = 0;
131+
$skipped = 0;
121132
if ( \is_array( $post_ids ) ) {
122133
foreach ( $post_ids as $post_id ) {
123134
$post = \get_post( $post_id );
124-
if ( ! empty( $post ) && ! $this->permissions_helper->is_rewrite_and_republish_copy( $post ) ) {
125-
if ( \intval( \get_option( 'duplicate_post_copychildren' ) !== 1 )
126-
|| ! \is_post_type_hierarchical( $post->post_type )
127-
|| ( \is_post_type_hierarchical( $post->post_type ) && ! Utils::has_ancestors_marked( $post, $post_ids ) )
128-
) {
129-
if ( ! \is_wp_error( \duplicate_post_create_duplicate( $post ) ) ) {
130-
++$counter;
131-
}
132-
}
135+
if ( empty( $post ) || $this->permissions_helper->is_rewrite_and_republish_copy( $post ) ) {
136+
continue;
137+
}
138+
if ( \intval( \get_option( 'duplicate_post_copychildren' ) ) === 1
139+
&& \is_post_type_hierarchical( $post->post_type )
140+
&& Utils::has_ancestors_marked( $post, $post_ids )
141+
) {
142+
continue;
143+
}
144+
if ( ! \current_user_can( 'edit_post', $post_id ) ) {
145+
++$skipped;
146+
continue;
147+
}
148+
if ( ! \is_wp_error( \duplicate_post_create_duplicate( $post ) ) ) {
149+
++$counter;
133150
}
134151
}
135152
}
136-
return \add_query_arg( 'bulk_cloned', $counter, $redirect_to );
153+
$redirect_to = \add_query_arg( 'bulk_cloned', $counter, $redirect_to );
154+
if ( $skipped > 0 ) {
155+
$redirect_to = \add_query_arg( 'bulk_cloned_skipped', $skipped, $redirect_to );
156+
}
157+
return $redirect_to;
137158
}
138159
}

‎src/post-republisher.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,14 @@ public function republish_request( $post ) {
142142
return;
143143
}
144144

145+
if ( ! \current_user_can( 'edit_post', $original_post->ID ) ) {
146+
\wp_die(
147+
\esc_html__( 'You are not allowed to republish this post.', 'duplicate-post' ),
148+
\esc_html__( 'Permission denied', 'duplicate-post' ),
149+
[ 'response' => 403 ]
150+
);
151+
}
152+
145153
$this->republish( $post, $original_post );
146154

147155
// Trigger the redirect in the Classic Editor.

‎src/watchers/bulk-actions-watcher.php‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,9 @@ public function register_hooks() {
3535
public function add_removable_query_args( $removable_query_args ) {
3636
if ( \is_array( $removable_query_args ) ) {
3737
$removable_query_args[] = 'bulk_cloned';
38+
$removable_query_args[] = 'bulk_cloned_skipped';
3839
$removable_query_args[] = 'bulk_rewriting';
40+
$removable_query_args[] = 'bulk_rewriting_skipped';
3941
}
4042
return $removable_query_args;
4143
}
@@ -62,6 +64,22 @@ public function add_bulk_clone_admin_notice() {
6264
\esc_html( $copied_posts ),
6365
);
6466
}
67+
if ( ! empty( $_REQUEST['bulk_cloned_skipped'] ) ) {
68+
$skipped_posts = \intval( $_REQUEST['bulk_cloned_skipped'] );
69+
\printf(
70+
'<div id="message" class="notice notice-warning fade"><p>'
71+
. \esc_html(
72+
/* translators: %s: Number of posts skipped. */
73+
\_n(
74+
'%s item skipped due to insufficient permissions.',
75+
'%s items skipped due to insufficient permissions.',
76+
$skipped_posts,
77+
'duplicate-post'
78+
)
79+
) . '</p></div>',
80+
\esc_html( $skipped_posts )
81+
);
82+
}
6583
}
6684

6785
/**
@@ -86,5 +104,21 @@ public function add_bulk_rewrite_and_republish_admin_notice() {
86104
\esc_html( $copied_posts ),
87105
);
88106
}
107+
if ( ! empty( $_REQUEST['bulk_rewriting_skipped'] ) ) {
108+
$skipped_posts = \intval( $_REQUEST['bulk_rewriting_skipped'] );
109+
\printf(
110+
'<div id="message" class="notice notice-warning fade"><p>'
111+
. \esc_html(
112+
/* translators: %s: Number of posts skipped. */
113+
\_n(
114+
'%s item skipped due to insufficient permissions.',
115+
'%s items skipped due to insufficient permissions.',
116+
$skipped_posts,
117+
'duplicate-post'
118+
)
119+
) . '</p></div>',
120+
\esc_html( $skipped_posts )
121+
);
122+
}
89123
}
90124
}

0 commit comments

Comments
 (0)