[wp-hackers] Plugin Port to 2.0: Showing private posts in single-view

[Filipe Fortes]

I'm the author of the PostLevels plugin, and I'm trying to port it to
WP 2.0. It's actually been slightly broken since 1.5.1, when the
following logic in get_posts() was changed (classes.php around line
641 in trunk):

			if ( ('publish' != $status) && ('static' != $status) ) {
				if ( ! (isset($user_ID) && ('' != intval($user_ID))) ) {
					// User must be logged in to view unpublished posts.
					$this->posts = array();
				} else {
					if ('draft' == $status) {
						// User must have edit permissions on the draft to preview.
						if (! current_user_can('edit_post', $this->posts[0]->ID)) {
							$this->posts = array();
						} else {
							$this->is_preview = true;
						}
					} else {
						if (! current_user_can('read_post', $this->posts[0]->ID))
							$this->posts = array();
					}
				}
			}

Considering the code is relatively unchanged in 2.0, I assume this
design will stay around.

I've gone through the code, and it seems like I should try to use the
"user_has_cap" filter which is called in WP_User.has_cap. I've managed
to get this working with the following hacky filter:

function postlevel_has_cap($capabilities)
{
  global $wp_query, $user_level, $postlevel_key;
  if (($wp_query->is_single) && (get_post_status($wp_query->posts[0])
== 'private'))
  {
    $post = $wp_query->posts[0];
    if (($post->meta_key == $postlevel_key) && (intval($user_level) >
$post->meta_value))
    {
      $capabilities['read_private_posts'] = 1;
    }
  }
  return $capabilities;
}

Questions for this list:

1. Is this code at all future proof? It works now because get_posts
only calls current_user_can for single posts? Should I be making my
filter more robust?

2. My filter only recieves one argument, although the apply_filter
which calls it passes three. Known issue?

3. Does any one see any red flags in this implementation?


Thanks!