Changeset 6713

Timestamp:

09/21/2017 02:18:40 AM (8 years ago)

Author:

johnjamesjacoby

Message:

Capabilities: prevent edits when past the edit-lock time.

This change increases the priority of the moderator check, so that moderators are not subjected to edit-lock restrictions, and maps to do_not_allow for topic/reply authors who normally can edit but are now beyond the allotted time period.

Fixes #3164. Props SergeyBiryukov.

Location:

trunk/src/includes

Files:

• replies/capabilities.php (modified) (2 diffs)
• topics/capabilities.php (modified) (1 diff)

trunk/src/includes/replies/capabilities.php

@@ -137 +137 @@
                     $caps = array( 'do_not_allow' );
 
-                // User is author so allow edit if not in admin
-                } elseif ( ! is_admin() && ( (int) $user_id === (int) $_post->post_author ) ) {
-                    $caps = array( $post_type->cap->edit_posts );
-
                 // Moderators can always edit forum content
                 } elseif ( user_can( $user_id, 'moderate', $_post->ID ) ) {
                     $caps = array( 'spectate' );
 
+                // Allow author or mod to edit if not in admin, unless past edit lock time
+                } elseif ( ! is_admin() && ( (int) $user_id === (int) $_post->post_author ) ) {
+
+                    // Only allow if not past the edit-lock period
+                    $caps = ! bbp_past_edit_lock( $_post->post_date_gmt )
+                        ? array( $post_type->cap->edit_posts )
+                        : array( 'do_not_allow' );
+
                 // Fallback to edit_others_posts.
                 } else {
@@ -168 +172 @@
                     $caps = array( 'do_not_allow' );
 
+                // Moderators can always edit forum content
+                } elseif ( user_can( $user_id, 'moderate', $_post->ID ) ) {
+                    $caps = array( 'spectate' );
+
                 // User is author so allow delete if not in admin
                 } elseif ( ! is_admin() && ( (int) $user_id === (int) $_post->post_author ) ) {
                     $caps = array( $post_type->cap->delete_posts );
 
-                // Moderators can always edit forum content
-                } elseif ( user_can( $user_id, 'moderate', $_post->ID ) ) {
-                    $caps = array( 'spectate' );
-
                 // Unknown so map to delete_others_posts
                 } else {

trunk/src/includes/topics/capabilities.php

@@ -157 +157 @@
                     $caps = array( 'do_not_allow' );
 
-                // User is author so allow edit if not in admin
-                } elseif ( ! is_admin() && ( (int) $user_id === (int) $_post->post_author ) ) {
-                    $caps = array( $post_type->cap->edit_posts );
-
                 // Moderators can always edit forum content
                 } elseif ( user_can( $user_id, 'moderate', $_post->ID ) ) {
                     $caps = array( 'spectate' );
+
+                // User is author so allow edit if not in admin, unless it's past edit lock time
+                } elseif ( ! is_admin() && ( (int) $user_id === (int) $_post->post_author ) ) {
+
+                    // Only allow if not past the edit-lock period
+                    $caps = ! bbp_past_edit_lock( $_post->post_date_gmt )
+                        ? array( $post_type->cap->edit_posts )
+                        : array( 'do_not_allow' );
 
                 // Unknown, so map to edit_others_posts