<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* Core User Role & Capabilities API

[2] Fix | Delete

*

[3] Fix | Delete

* @package WordPress

[4] Fix | Delete

* @subpackage Users

[5] Fix | Delete

*/

[6] Fix | Delete

[7] Fix | Delete

/**

[8] Fix | Delete

* Maps a capability to the primitive capabilities required of the given user to

[9] Fix | Delete

* satisfy the capability being checked.

[10] Fix | Delete

*

[11] Fix | Delete

* This function also accepts an ID of an object to map against if the capability is a meta capability. Meta

[12] Fix | Delete

* capabilities such as `edit_post` and `edit_user` are capabilities used by this function to map to primitive

[13] Fix | Delete

* capabilities that a user or role requires, such as `edit_posts` and `edit_others_posts`.

[14] Fix | Delete

*

[15] Fix | Delete

* Example usage:

[16] Fix | Delete

*

[17] Fix | Delete

* map_meta_cap( 'edit_posts', $user->ID );

[18] Fix | Delete

* map_meta_cap( 'edit_post', $user->ID, $post->ID );

[19] Fix | Delete

* map_meta_cap( 'edit_post_meta', $user->ID, $post->ID, $meta_key );

[20] Fix | Delete

*

[21] Fix | Delete

* This function does not check whether the user has the required capabilities,

[22] Fix | Delete

* it just returns what the required capabilities are.

[23] Fix | Delete

*

[24] Fix | Delete

* @since 2.0.0

[25] Fix | Delete

* @since 4.9.6 Added the `export_others_personal_data`, `erase_others_personal_data`,

[26] Fix | Delete

* and `manage_privacy_options` capabilities.

[27] Fix | Delete

* @since 5.1.0 Added the `update_php` capability.

[28] Fix | Delete

* @since 5.2.0 Added the `resume_plugin` and `resume_theme` capabilities.

[29] Fix | Delete

* @since 5.3.0 Formalized the existing and already documented `...$args` parameter

[30] Fix | Delete

* by adding it to the function signature.

[31] Fix | Delete

* @since 5.7.0 Added the `create_app_password`, `list_app_passwords`, `read_app_password`,

[32] Fix | Delete

* `edit_app_password`, `delete_app_passwords`, `delete_app_password`,

[33] Fix | Delete

* and `update_https` capabilities.

[34] Fix | Delete

*

[35] Fix | Delete

* @global array $post_type_meta_caps Used to get post type meta capabilities.

[36] Fix | Delete

*

[37] Fix | Delete

* @param string $cap Capability being checked.

[38] Fix | Delete

* @param int $user_id User ID.

[39] Fix | Delete

* @param mixed ...$args Optional further parameters, typically starting with an object ID.

[40] Fix | Delete

* @return string[] Primitive capabilities required of the user.

[41] Fix | Delete

*/

[42] Fix | Delete

function map_meta_cap( $cap, $user_id, ...$args ) {

[43] Fix | Delete

$caps = array();

[44] Fix | Delete

[45] Fix | Delete

switch ( $cap ) {

[46] Fix | Delete

case 'remove_user':

[47] Fix | Delete

// In multisite the user must be a super admin to remove themselves.

[48] Fix | Delete

if ( isset( $args[0] ) && $user_id == $args[0] && ! is_super_admin( $user_id ) ) {

[49] Fix | Delete

$caps[] = 'do_not_allow';

[50] Fix | Delete

} else {

[51] Fix | Delete

$caps[] = 'remove_users';

[52] Fix | Delete

}

[53] Fix | Delete

break;

[54] Fix | Delete

case 'promote_user':

[55] Fix | Delete

case 'add_users':

[56] Fix | Delete

$caps[] = 'promote_users';

[57] Fix | Delete

break;

[58] Fix | Delete

case 'edit_user':

[59] Fix | Delete

case 'edit_users':

[60] Fix | Delete

// Allow user to edit themselves.

[61] Fix | Delete

if ( 'edit_user' === $cap && isset( $args[0] ) && $user_id == $args[0] ) {

[62] Fix | Delete

break;

[63] Fix | Delete

}

[64] Fix | Delete

[65] Fix | Delete

// In multisite the user must have manage_network_users caps. If editing a super admin, the user must be a super admin.

[66] Fix | Delete

if ( is_multisite() && ( ( ! is_super_admin( $user_id ) && 'edit_user' === $cap && is_super_admin( $args[0] ) ) || ! user_can( $user_id, 'manage_network_users' ) ) ) {

[67] Fix | Delete

$caps[] = 'do_not_allow';

[68] Fix | Delete

} else {

[69] Fix | Delete

$caps[] = 'edit_users'; // edit_user maps to edit_users.

[70] Fix | Delete

}

[71] Fix | Delete

break;

[72] Fix | Delete

case 'delete_post':

[73] Fix | Delete

case 'delete_page':

[74] Fix | Delete

$post = get_post( $args[0] );

[75] Fix | Delete

if ( ! $post ) {

[76] Fix | Delete

$caps[] = 'do_not_allow';

[77] Fix | Delete

break;

[78] Fix | Delete

}

[79] Fix | Delete

[80] Fix | Delete

if ( 'revision' === $post->post_type ) {

[81] Fix | Delete

$caps[] = 'do_not_allow';

[82] Fix | Delete

break;

[83] Fix | Delete

}

[84] Fix | Delete

[85] Fix | Delete

if ( ( get_option( 'page_for_posts' ) == $post->ID ) || ( get_option( 'page_on_front' ) == $post->ID ) ) {

[86] Fix | Delete

$caps[] = 'manage_options';

[87] Fix | Delete

break;

[88] Fix | Delete

}

[89] Fix | Delete

[90] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[91] Fix | Delete

if ( ! $post_type ) {

[92] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[93] Fix | Delete

_doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );

[94] Fix | Delete

$caps[] = 'edit_others_posts';

[95] Fix | Delete

break;

[96] Fix | Delete

}

[97] Fix | Delete

[98] Fix | Delete

if ( ! $post_type->map_meta_cap ) {

[99] Fix | Delete

$caps[] = $post_type->cap->$cap;

[100] Fix | Delete

// Prior to 3.1 we would re-call map_meta_cap here.

[101] Fix | Delete

if ( 'delete_post' === $cap ) {

[102] Fix | Delete

$cap = $post_type->cap->$cap;

[103] Fix | Delete

}

[104] Fix | Delete

break;

[105] Fix | Delete

}

[106] Fix | Delete

[107] Fix | Delete

// If the post author is set and the user is the author...

[108] Fix | Delete

if ( $post->post_author && $user_id == $post->post_author ) {

[109] Fix | Delete

// If the post is published or scheduled...

[110] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[111] Fix | Delete

$caps[] = $post_type->cap->delete_published_posts;

[112] Fix | Delete

} elseif ( 'trash' === $post->post_status ) {

[113] Fix | Delete

$status = get_post_meta( $post->ID, '_wp_trash_meta_status', true );

[114] Fix | Delete

if ( in_array( $status, array( 'publish', 'future' ), true ) ) {

[115] Fix | Delete

$caps[] = $post_type->cap->delete_published_posts;

[116] Fix | Delete

} else {

[117] Fix | Delete

$caps[] = $post_type->cap->delete_posts;

[118] Fix | Delete

}

[119] Fix | Delete

} else {

[120] Fix | Delete

// If the post is draft...

[121] Fix | Delete

$caps[] = $post_type->cap->delete_posts;

[122] Fix | Delete

}

[123] Fix | Delete

} else {

[124] Fix | Delete

// The user is trying to edit someone else's post.

[125] Fix | Delete

$caps[] = $post_type->cap->delete_others_posts;

[126] Fix | Delete

// The post is published or scheduled, extra cap required.

[127] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[128] Fix | Delete

$caps[] = $post_type->cap->delete_published_posts;

[129] Fix | Delete

} elseif ( 'private' === $post->post_status ) {

[130] Fix | Delete

$caps[] = $post_type->cap->delete_private_posts;

[131] Fix | Delete

}

[132] Fix | Delete

}

[133] Fix | Delete

[134] Fix | Delete

/*

[135] Fix | Delete

* Setting the privacy policy page requires `manage_privacy_options`,

[136] Fix | Delete

* so deleting it should require that too.

[137] Fix | Delete

*/

[138] Fix | Delete

if ( (int) get_option( 'wp_page_for_privacy_policy' ) === $post->ID ) {

[139] Fix | Delete

$caps = array_merge( $caps, map_meta_cap( 'manage_privacy_options', $user_id ) );

[140] Fix | Delete

}

[141] Fix | Delete

[142] Fix | Delete

break;

[143] Fix | Delete

// edit_post breaks down to edit_posts, edit_published_posts, or

[144] Fix | Delete

// edit_others_posts.

[145] Fix | Delete

case 'edit_post':

[146] Fix | Delete

case 'edit_page':

[147] Fix | Delete

$post = get_post( $args[0] );

[148] Fix | Delete

if ( ! $post ) {

[149] Fix | Delete

$caps[] = 'do_not_allow';

[150] Fix | Delete

break;

[151] Fix | Delete

}

[152] Fix | Delete

[153] Fix | Delete

if ( 'revision' === $post->post_type ) {

[154] Fix | Delete

$post = get_post( $post->post_parent );

[155] Fix | Delete

if ( ! $post ) {

[156] Fix | Delete

$caps[] = 'do_not_allow';

[157] Fix | Delete

break;

[158] Fix | Delete

}

[159] Fix | Delete

}

[160] Fix | Delete

[161] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[162] Fix | Delete

if ( ! $post_type ) {

[163] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[164] Fix | Delete

_doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );

[165] Fix | Delete

$caps[] = 'edit_others_posts';

[166] Fix | Delete

break;

[167] Fix | Delete

}

[168] Fix | Delete

[169] Fix | Delete

if ( ! $post_type->map_meta_cap ) {

[170] Fix | Delete

$caps[] = $post_type->cap->$cap;

[171] Fix | Delete

// Prior to 3.1 we would re-call map_meta_cap here.

[172] Fix | Delete

if ( 'edit_post' === $cap ) {

[173] Fix | Delete

$cap = $post_type->cap->$cap;

[174] Fix | Delete

}

[175] Fix | Delete

break;

[176] Fix | Delete

}

[177] Fix | Delete

[178] Fix | Delete

// If the post author is set and the user is the author...

[179] Fix | Delete

if ( $post->post_author && $user_id == $post->post_author ) {

[180] Fix | Delete

// If the post is published or scheduled...

[181] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[182] Fix | Delete

$caps[] = $post_type->cap->edit_published_posts;

[183] Fix | Delete

} elseif ( 'trash' === $post->post_status ) {

[184] Fix | Delete

$status = get_post_meta( $post->ID, '_wp_trash_meta_status', true );

[185] Fix | Delete

if ( in_array( $status, array( 'publish', 'future' ), true ) ) {

[186] Fix | Delete

$caps[] = $post_type->cap->edit_published_posts;

[187] Fix | Delete

} else {

[188] Fix | Delete

$caps[] = $post_type->cap->edit_posts;

[189] Fix | Delete

}

[190] Fix | Delete

} else {

[191] Fix | Delete

// If the post is draft...

[192] Fix | Delete

$caps[] = $post_type->cap->edit_posts;

[193] Fix | Delete

}

[194] Fix | Delete

} else {

[195] Fix | Delete

// The user is trying to edit someone else's post.

[196] Fix | Delete

$caps[] = $post_type->cap->edit_others_posts;

[197] Fix | Delete

// The post is published or scheduled, extra cap required.

[198] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[199] Fix | Delete

$caps[] = $post_type->cap->edit_published_posts;

[200] Fix | Delete

} elseif ( 'private' === $post->post_status ) {

[201] Fix | Delete

$caps[] = $post_type->cap->edit_private_posts;

[202] Fix | Delete

}

[203] Fix | Delete

}

[204] Fix | Delete

[205] Fix | Delete

/*

[206] Fix | Delete

* Setting the privacy policy page requires `manage_privacy_options`,

[207] Fix | Delete

* so editing it should require that too.

[208] Fix | Delete

*/

[209] Fix | Delete

if ( (int) get_option( 'wp_page_for_privacy_policy' ) === $post->ID ) {

[210] Fix | Delete

$caps = array_merge( $caps, map_meta_cap( 'manage_privacy_options', $user_id ) );

[211] Fix | Delete

}

[212] Fix | Delete

[213] Fix | Delete

break;

[214] Fix | Delete

case 'read_post':

[215] Fix | Delete

case 'read_page':

[216] Fix | Delete

$post = get_post( $args[0] );

[217] Fix | Delete

if ( ! $post ) {

[218] Fix | Delete

$caps[] = 'do_not_allow';

[219] Fix | Delete

break;

[220] Fix | Delete

}

[221] Fix | Delete

[222] Fix | Delete

if ( 'revision' === $post->post_type ) {

[223] Fix | Delete

$post = get_post( $post->post_parent );

[224] Fix | Delete

if ( ! $post ) {

[225] Fix | Delete

$caps[] = 'do_not_allow';

[226] Fix | Delete

break;

[227] Fix | Delete

}

[228] Fix | Delete

}

[229] Fix | Delete

[230] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[231] Fix | Delete

if ( ! $post_type ) {

[232] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[233] Fix | Delete

_doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );

[234] Fix | Delete

$caps[] = 'edit_others_posts';

[235] Fix | Delete

break;

[236] Fix | Delete

}

[237] Fix | Delete

[238] Fix | Delete

if ( ! $post_type->map_meta_cap ) {

[239] Fix | Delete

$caps[] = $post_type->cap->$cap;

[240] Fix | Delete

// Prior to 3.1 we would re-call map_meta_cap here.

[241] Fix | Delete

if ( 'read_post' === $cap ) {

[242] Fix | Delete

$cap = $post_type->cap->$cap;

[243] Fix | Delete

}

[244] Fix | Delete

break;

[245] Fix | Delete

}

[246] Fix | Delete

[247] Fix | Delete

$status_obj = get_post_status_object( get_post_status( $post ) );

[248] Fix | Delete

if ( ! $status_obj ) {

[249] Fix | Delete

/* translators: 1: Post status, 2: Capability name. */

[250] Fix | Delete

_doing_it_wrong( __FUNCTION__, sprintf( __( 'The post status %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post with that status.' ), get_post_status( $post ), $cap ), '5.4.0' );

[251] Fix | Delete

$caps[] = 'edit_others_posts';

[252] Fix | Delete

break;

[253] Fix | Delete

}

[254] Fix | Delete

[255] Fix | Delete

if ( $status_obj->public ) {

[256] Fix | Delete

$caps[] = $post_type->cap->read;

[257] Fix | Delete

break;

[258] Fix | Delete

}

[259] Fix | Delete

[260] Fix | Delete

if ( $post->post_author && $user_id == $post->post_author ) {

[261] Fix | Delete

$caps[] = $post_type->cap->read;

[262] Fix | Delete

} elseif ( $status_obj->private ) {

[263] Fix | Delete

$caps[] = $post_type->cap->read_private_posts;

[264] Fix | Delete

} else {

[265] Fix | Delete

$caps = map_meta_cap( 'edit_post', $user_id, $post->ID );

[266] Fix | Delete

}

[267] Fix | Delete

break;

[268] Fix | Delete

case 'publish_post':

[269] Fix | Delete

$post = get_post( $args[0] );

[270] Fix | Delete

if ( ! $post ) {

[271] Fix | Delete

$caps[] = 'do_not_allow';

[272] Fix | Delete

break;

[273] Fix | Delete

}

[274] Fix | Delete

[275] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[276] Fix | Delete

if ( ! $post_type ) {

[277] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[278] Fix | Delete

_doing_it_wrong( __FUNCTION__, sprintf( __( 'The post type %1$s is not registered, so it may not be reliable to check the capability "%2$s" against a post of that type.' ), $post->post_type, $cap ), '4.4.0' );

[279] Fix | Delete

$caps[] = 'edit_others_posts';

[280] Fix | Delete

break;

[281] Fix | Delete

}

[282] Fix | Delete

[283] Fix | Delete

$caps[] = $post_type->cap->publish_posts;

[284] Fix | Delete

break;

[285] Fix | Delete

case 'edit_post_meta':

[286] Fix | Delete

case 'delete_post_meta':

[287] Fix | Delete

case 'add_post_meta':

[288] Fix | Delete

case 'edit_comment_meta':

[289] Fix | Delete

case 'delete_comment_meta':

[290] Fix | Delete

case 'add_comment_meta':

[291] Fix | Delete

case 'edit_term_meta':

[292] Fix | Delete

case 'delete_term_meta':

[293] Fix | Delete

case 'add_term_meta':

[294] Fix | Delete

case 'edit_user_meta':

[295] Fix | Delete

case 'delete_user_meta':

[296] Fix | Delete

case 'add_user_meta':

[297] Fix | Delete

$object_type = explode( '_', $cap )[1];

[298] Fix | Delete

$object_id = (int) $args[0];

[299] Fix | Delete

[300] Fix | Delete

$object_subtype = get_object_subtype( $object_type, $object_id );

[301] Fix | Delete

[302] Fix | Delete

if ( empty( $object_subtype ) ) {

[303] Fix | Delete

$caps[] = 'do_not_allow';

[304] Fix | Delete

break;

[305] Fix | Delete

}

[306] Fix | Delete

[307] Fix | Delete

$caps = map_meta_cap( "edit_{$object_type}", $user_id, $object_id );

[308] Fix | Delete

[309] Fix | Delete

$meta_key = isset( $args[1] ) ? $args[1] : false;

[310] Fix | Delete

[311] Fix | Delete

if ( $meta_key ) {

[312] Fix | Delete

$allowed = ! is_protected_meta( $meta_key, $object_type );

[313] Fix | Delete

[314] Fix | Delete

if ( ! empty( $object_subtype ) && has_filter( "auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype}" ) ) {

[315] Fix | Delete

[316] Fix | Delete

/**

[317] Fix | Delete

* Filters whether the user is allowed to edit a specific meta key of a specific object type and subtype.

[318] Fix | Delete

*

[319] Fix | Delete

* The dynamic portions of the hook name, `$object_type`, `$meta_key`,

[320] Fix | Delete

* and `$object_subtype`, refer to the metadata object type (comment, post, term or user),

[321] Fix | Delete

* the meta key value, and the object subtype respectively.

[322] Fix | Delete

*

[323] Fix | Delete

* @since 4.9.8

[324] Fix | Delete

*

[325] Fix | Delete

* @param bool $allowed Whether the user can add the object meta. Default false.

[326] Fix | Delete

* @param string $meta_key The meta key.

[327] Fix | Delete

* @param int $object_id Object ID.

[328] Fix | Delete

* @param int $user_id User ID.

[329] Fix | Delete

* @param string $cap Capability name.

[330] Fix | Delete

* @param string[] $caps Array of the user's capabilities.

[331] Fix | Delete

*/

[332] Fix | Delete

$allowed = apply_filters( "auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype}", $allowed, $meta_key, $object_id, $user_id, $cap, $caps );

[333] Fix | Delete

} else {

[334] Fix | Delete

[335] Fix | Delete

/**

[336] Fix | Delete

* Filters whether the user is allowed to edit a specific meta key of a specific object type.

[337] Fix | Delete

*

[338] Fix | Delete

* Return true to have the mapped meta caps from `edit_{$object_type}` apply.

[339] Fix | Delete

*

[340] Fix | Delete

* The dynamic portion of the hook name, `$object_type` refers to the object type being filtered.

[341] Fix | Delete

* The dynamic portion of the hook name, `$meta_key`, refers to the meta key passed to map_meta_cap().

[342] Fix | Delete

*

[343] Fix | Delete

* @since 3.3.0 As `auth_post_meta_{$meta_key}`.

[344] Fix | Delete

* @since 4.6.0

[345] Fix | Delete

*

[346] Fix | Delete

* @param bool $allowed Whether the user can add the object meta. Default false.

[347] Fix | Delete

* @param string $meta_key The meta key.

[348] Fix | Delete

* @param int $object_id Object ID.

[349] Fix | Delete

* @param int $user_id User ID.

[350] Fix | Delete

* @param string $cap Capability name.

[351] Fix | Delete

* @param string[] $caps Array of the user's capabilities.

[352] Fix | Delete

*/

[353] Fix | Delete

$allowed = apply_filters( "auth_{$object_type}_meta_{$meta_key}", $allowed, $meta_key, $object_id, $user_id, $cap, $caps );

[354] Fix | Delete

}

[355] Fix | Delete

[356] Fix | Delete

if ( ! empty( $object_subtype ) ) {

[357] Fix | Delete

[358] Fix | Delete

/**

[359] Fix | Delete

* Filters whether the user is allowed to edit meta for specific object types/subtypes.

[360] Fix | Delete

*

[361] Fix | Delete

* Return true to have the mapped meta caps from `edit_{$object_type}` apply.

[362] Fix | Delete

*

[363] Fix | Delete

* The dynamic portion of the hook name, `$object_type` refers to the object type being filtered.

[364] Fix | Delete

* The dynamic portion of the hook name, `$object_subtype` refers to the object subtype being filtered.

[365] Fix | Delete

* The dynamic portion of the hook name, `$meta_key`, refers to the meta key passed to map_meta_cap().

[366] Fix | Delete

*

[367] Fix | Delete

* @since 4.6.0 As `auth_post_{$post_type}_meta_{$meta_key}`.

[368] Fix | Delete

* @since 4.7.0 Renamed from `auth_post_{$post_type}_meta_{$meta_key}` to

[369] Fix | Delete

* `auth_{$object_type}_{$object_subtype}_meta_{$meta_key}`.

[370] Fix | Delete

* @deprecated 4.9.8 Use {@see 'auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype}'} instead.

[371] Fix | Delete

*

[372] Fix | Delete

* @param bool $allowed Whether the user can add the object meta. Default false.

[373] Fix | Delete

* @param string $meta_key The meta key.

[374] Fix | Delete

* @param int $object_id Object ID.

[375] Fix | Delete

* @param int $user_id User ID.

[376] Fix | Delete

* @param string $cap Capability name.

[377] Fix | Delete

* @param string[] $caps Array of the user's capabilities.

[378] Fix | Delete

*/

[379] Fix | Delete

$allowed = apply_filters_deprecated(

[380] Fix | Delete

"auth_{$object_type}_{$object_subtype}_meta_{$meta_key}",

[381] Fix | Delete

array( $allowed, $meta_key, $object_id, $user_id, $cap, $caps ),

[382] Fix | Delete

'4.9.8',

[383] Fix | Delete

"auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype}"

[384] Fix | Delete

);

[385] Fix | Delete

}

[386] Fix | Delete

[387] Fix | Delete

if ( ! $allowed ) {

[388] Fix | Delete

$caps[] = $cap;

[389] Fix | Delete

}

[390] Fix | Delete

}

[391] Fix | Delete

break;

[392] Fix | Delete

case 'edit_comment':

[393] Fix | Delete

$comment = get_comment( $args[0] );

[394] Fix | Delete

if ( ! $comment ) {

[395] Fix | Delete

$caps[] = 'do_not_allow';

[396] Fix | Delete

break;

[397] Fix | Delete

}

[398] Fix | Delete

[399] Fix | Delete

$post = get_post( $comment->comment_post_ID );

[400] Fix | Delete

[401] Fix | Delete

/*

[402] Fix | Delete

* If the post doesn't exist, we have an orphaned comment.

[403] Fix | Delete

* Fall back to the edit_posts capability, instead.

[404] Fix | Delete

*/

[405] Fix | Delete

if ( $post ) {

[406] Fix | Delete

$caps = map_meta_cap( 'edit_post', $user_id, $post->ID );

[407] Fix | Delete

} else {

[408] Fix | Delete

$caps = map_meta_cap( 'edit_posts', $user_id );

[409] Fix | Delete

}

[410] Fix | Delete

break;

[411] Fix | Delete

case 'unfiltered_upload':

[412] Fix | Delete

if ( defined( 'ALLOW_UNFILTERED_UPLOADS' ) && ALLOW_UNFILTERED_UPLOADS && ( ! is_multisite() || is_super_admin( $user_id ) ) ) {

[413] Fix | Delete

$caps[] = $cap;

[414] Fix | Delete

} else {

[415] Fix | Delete

$caps[] = 'do_not_allow';

[416] Fix | Delete

}

[417] Fix | Delete

break;

[418] Fix | Delete

case 'edit_css':

[419] Fix | Delete

case 'unfiltered_html':

[420] Fix | Delete

// Disallow unfiltered_html for all users, even admins and super admins.

[421] Fix | Delete

if ( defined( 'DISALLOW_UNFILTERED_HTML' ) && DISALLOW_UNFILTERED_HTML ) {

[422] Fix | Delete

$caps[] = 'do_not_allow';

[423] Fix | Delete

} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {

[424] Fix | Delete

$caps[] = 'do_not_allow';

[425] Fix | Delete

} else {

[426] Fix | Delete

$caps[] = 'unfiltered_html';

[427] Fix | Delete

}

[428] Fix | Delete

break;

[429] Fix | Delete

case 'edit_files':

[430] Fix | Delete

case 'edit_plugins':

[431] Fix | Delete

case 'edit_themes':

[432] Fix | Delete

// Disallow the file editors.

[433] Fix | Delete

if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT ) {

[434] Fix | Delete

$caps[] = 'do_not_allow';

[435] Fix | Delete

} elseif ( ! wp_is_file_mod_allowed( 'capability_edit_themes' ) ) {

[436] Fix | Delete

$caps[] = 'do_not_allow';

[437] Fix | Delete

} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {

[438] Fix | Delete

$caps[] = 'do_not_allow';

[439] Fix | Delete

} else {

[440] Fix | Delete

$caps[] = $cap;

[441] Fix | Delete

}

[442] Fix | Delete

break;

[443] Fix | Delete

case 'update_plugins':

[444] Fix | Delete

case 'delete_plugins':

[445] Fix | Delete

case 'install_plugins':

[446] Fix | Delete

case 'upload_plugins':

[447] Fix | Delete

case 'update_themes':

[448] Fix | Delete

case 'delete_themes':

[449] Fix | Delete

case 'install_themes':

[450] Fix | Delete

case 'upload_themes':

[451] Fix | Delete

case 'update_core':

[452] Fix | Delete

// Disallow anything that creates, deletes, or updates core, plugin, or theme files.

[453] Fix | Delete

// Files in uploads are excepted.

[454] Fix | Delete

if ( ! wp_is_file_mod_allowed( 'capability_update_core' ) ) {

[455] Fix | Delete

$caps[] = 'do_not_allow';

[456] Fix | Delete

} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {

[457] Fix | Delete

$caps[] = 'do_not_allow';

[458] Fix | Delete

} elseif ( 'upload_themes' === $cap ) {

[459] Fix | Delete

$caps[] = 'install_themes';

[460] Fix | Delete

} elseif ( 'upload_plugins' === $cap ) {

[461] Fix | Delete

$caps[] = 'install_plugins';

[462] Fix | Delete

} else {

[463] Fix | Delete

$caps[] = $cap;

[464] Fix | Delete

}

[465] Fix | Delete

break;

[466] Fix | Delete

case 'install_languages':

[467] Fix | Delete

case 'update_languages':

[468] Fix | Delete

if ( ! wp_is_file_mod_allowed( 'can_install_language_pack' ) ) {

[469] Fix | Delete

$caps[] = 'do_not_allow';

[470] Fix | Delete

} elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {

[471] Fix | Delete

$caps[] = 'do_not_allow';

[472] Fix | Delete

} else {

[473] Fix | Delete

$caps[] = 'install_languages';

[474] Fix | Delete

}

[475] Fix | Delete

break;

[476] Fix | Delete

case 'activate_plugins':

[477] Fix | Delete

case 'deactivate_plugins':

[478] Fix | Delete

case 'activate_plugin':

[479] Fix | Delete

case 'deactivate_plugin':

[480] Fix | Delete

$caps[] = 'activate_plugins';

[481] Fix | Delete

if ( is_multisite() ) {

[482] Fix | Delete

// update_, install_, and delete_ are handled above with is_super_admin().

[483] Fix | Delete

$menu_perms = get_site_option( 'menu_items', array() );

[484] Fix | Delete

if ( empty( $menu_perms['plugins'] ) ) {

[485] Fix | Delete

$caps[] = 'manage_network_plugins';

[486] Fix | Delete

}

[487] Fix | Delete

}

[488] Fix | Delete

break;

[489] Fix | Delete

case 'resume_plugin':

[490] Fix | Delete

$caps[] = 'resume_plugins';

[491] Fix | Delete

break;

[492] Fix | Delete

case 'resume_theme':

[493] Fix | Delete

$caps[] = 'resume_themes';

[494] Fix | Delete

break;

[495] Fix | Delete

case 'delete_user':

[496] Fix | Delete

case 'delete_users':

[497] Fix | Delete

// If multisite only super admins can delete users.

[498] Fix | Delete

if ( is_multisite() && ! is_super_admin( $user_id ) ) {

[499] Fix | Delete