[wp-hackers] map_meta_cap returns empty array for edit_post

[Nikola Nikolov]

Hi everyone,

I'm trying to conditionally set post-related capabilities and I'm surprised
to see that in certain situations that fails.

I believe the culprit is the map_meta_cap function(since in
WP_User::has_cap() $caps is an empty array). The post in question is in the
trash and I'd like to forbid certain users to restore the post. The problem
is with the following check (
https://github.com/WordPress/WordPress/blob/4.0-branch/wp-includes/capabilities.php#L1139
):

...
} elseif ( 'trash' == $post->post_status ) {
if ( 'publish' == get_post_meta( $post->ID, '_wp_trash_meta_status', true )
) {
$caps[] = $post_type->cap->edit_published_posts;
}
} else {
...

If the _wp_trash_meta_status is not publish, then no actual capability is
mapped to the requested one. Hence WP_User::has_cap() returns true and it's
impossible to filter the capability.

Is this the intended behaviour, or is this a bug that somehow managed to
sneak-in? If it's a bug, then I'll post a ticket on Track, but if it's not
I'd be curious to hear why it works that way.

All the best,
Nikola