[wp-trac] [WordPress Trac] #42464: Replace `publish_posts` permission check in `wp_insert_post()`.

[WordPress Trac]

#42464: Replace `publish_posts` permission check in `wp_insert_post()`.
-----------------------------+------------------------------------------
 Reporter:  peterwilsoncc    |      Owner:
     Type:  defect (bug)     |     Status:  new
 Priority:  normal           |  Milestone:  5.0
Component:  Role/Capability  |    Version:  2.7
 Severity:  normal           |   Keywords:  needs-patch needs-unit-tests
  Focuses:                   |
-----------------------------+------------------------------------------
 `wp_insert_post()` includes a permission check to prevent contributors
 from setting the slug:

 {{{
 // Don't allow contributors to set the post slug for pending review posts.
 if ( 'pending' == $post_status && ! current_user_can( 'publish_posts' ) )
 {
         $post_name = '';
 }
 }}}

 To ensure WP is checking permissions against the correct post type, the
 check should be changed to the following for new posts:

 {{{
 current_user_can( get_post_type_object( /**/ )->cap->publish_posts )
 }}}

 For post updates, the check should be changed to:

 {{{
 current_user_can( 'publish_post', $postID )
 }}}

 Tests will need to include:

 * CPTs mapping meta caps
 * CPTs not mapping meta caps
 * CPTs using custom caps (eg `cpt_publish_posts`) with various user roles
 * CPTs not using custom caps
 * core post types

--
Ticket URL: <https://core.trac.wordpress.org/ticket/42464>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform