Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-06-21 04:15:01 +02:00
Code Issues Projects Releases Wiki Activity

Grouped merges for 5.6.3.

Browse Source 
* REST API: Allow authors to read their own password protected posts.
* About page update.

Merges [50717] to the 5.6 branch.

Built from https://develop.svn.wordpress.org/branches/5.6@50726


git-svn-id: http://core.svn.wordpress.org/branches/5.6@50335 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
desrosj 2021-04-15 01:08:03 +00:00
parent d433acb528
commit c9370870af
3 changed files with 75 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
wp-admin/about.php
View File

@ -74,6 +74,26 @@ require_once ABSPATH . 'wp-admin/admin-header.php';
<div class="about__section changelog">
<div class="column has-border has-subtle-background-color">
<h2 class="is-smaller-heading"><?php _e( 'Maintenance and Security Releases' ); ?></h2>
<p>
<?php
printf(
/* translators: %s: WordPress version number */
__( '<strong>Version %s</strong> addressed some security issues.' ),
'5.6.3'
);
?>
<?php
printf(
/* translators: %s: HelpHub URL */
__( 'For more information, see <a href="%s">the release notes</a>.' ),
sprintf(
/* translators: %s: WordPress version */
esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
sanitize_title( '5.6.3' )
)
);
?>
</p>
<p>
<?php
printf(

61
wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
View File

@ -31,6 +31,14 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
*/
protected $meta;
/**
* Passwordless post access permitted.
*
* @since 5.7.1
* @var int[]
*/
protected $password_check_passed = array();
/**
* Constructor.
*
@ -148,6 +156,38 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
return true;
}
/**
* Override the result of the post password check for REST requested posts.
*
* Allow users to read the content of password protected posts if they have
* previously passed a permission check or if they have the `edit_post` capability
* for the post being checked.
*
* @since 5.7.1
*
* @param bool $required Whether the post requires a password check.
* @param WP_Post $post The post been password checked.
* @return bool Result of password check taking in to account REST API considerations.
*/
public function check_password_required( $required, $post ) {
if ( ! $required ) {
return $required;
}
$post = get_post( $post );
if ( ! $post ) {
return $required;
}
if ( ! empty( $this->password_check_passed[ $post->ID ] ) ) {
// Password previously checked and approved.
return false;
}
return ! current_user_can( 'edit_post', $post->ID );
}
/**
* Retrieves a collection of posts.
*
@ -315,7 +355,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
// Allow access to all password protected posts if the context is edit.
if ( 'edit' === $request['context'] ) {
add_filter( 'post_password_required', '__return_false' );
add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
}
$posts = array();
@ -331,7 +371,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
// Reset filter.
if ( 'edit' === $request['context'] ) {
remove_filter( 'post_password_required', '__return_false' );
remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
}
$page = (int) $query_args['paged'];
@ -446,7 +486,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
// Allow access to all password protected posts if the context is edit.
if ( 'edit' === $request['context'] ) {
add_filter( 'post_password_required', '__return_false' );
add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
}
if ( $post ) {
@ -474,8 +514,14 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
return false;
}
// Edit context always gets access to password-protected posts.
if ( 'edit' === $request['context'] ) {
/*
* Users always gets access to password protected content in the edit
* context if they have the `edit_post` meta capability.
*/
if (
'edit' === $request['context'] &&
current_user_can( 'edit_post', $post->ID )
) {
return true;
}
@ -1705,8 +1751,9 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
$has_password_filter = false;
if ( $this->can_access_password_content( $post, $request ) ) {
$this->password_check_passed[ $post->ID ] = true;
// Allow access to the post, permissions already checked before.
add_filter( 'post_password_required', '__return_false' );
add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
$has_password_filter = true;
}
@ -1744,7 +1791,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
if ( $has_password_filter ) {
// Reset filter.
remove_filter( 'post_password_required', '__return_false' );
remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
}
if ( rest_is_field_included( 'author', $fields ) ) {

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.6.3-alpha-50721';
$wp_version = '5.6.3-alpha-50726';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.