<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* Core User Role & Capabilities API

[2] Fix | Delete

*

[3] Fix | Delete

* @package WordPress

[4] Fix | Delete

* @subpackage Users

[5] Fix | Delete

*/

[6] Fix | Delete

[7] Fix | Delete

/**

[8] Fix | Delete

* Maps a capability to the primitive capabilities required of the given user to

[9] Fix | Delete

* satisfy the capability being checked.

[10] Fix | Delete

*

[11] Fix | Delete

* This function also accepts an ID of an object to map against if the capability is a meta capability. Meta

[12] Fix | Delete

* capabilities such as `edit_post` and `edit_user` are capabilities used by this function to map to primitive

[13] Fix | Delete

* capabilities that a user or role requires, such as `edit_posts` and `edit_others_posts`.

[14] Fix | Delete

*

[15] Fix | Delete

* Example usage:

[16] Fix | Delete

*

[17] Fix | Delete

* map_meta_cap( 'edit_posts', $user->ID );

[18] Fix | Delete

* map_meta_cap( 'edit_post', $user->ID, $post->ID );

[19] Fix | Delete

* map_meta_cap( 'edit_post_meta', $user->ID, $post->ID, $meta_key );

[20] Fix | Delete

*

[21] Fix | Delete

* This function does not check whether the user has the required capabilities,

[22] Fix | Delete

* it just returns what the required capabilities are.

[23] Fix | Delete

*

[24] Fix | Delete

* @since 2.0.0

[25] Fix | Delete

* @since 4.9.6 Added the `export_others_personal_data`, `erase_others_personal_data`,

[26] Fix | Delete

* and `manage_privacy_options` capabilities.

[27] Fix | Delete

* @since 5.1.0 Added the `update_php` capability.

[28] Fix | Delete

* @since 5.2.0 Added the `resume_plugin` and `resume_theme` capabilities.

[29] Fix | Delete

* @since 5.3.0 Formalized the existing and already documented `...$args` parameter

[30] Fix | Delete

* by adding it to the function signature.

[31] Fix | Delete

* @since 5.7.0 Added the `create_app_password`, `list_app_passwords`, `read_app_password`,

[32] Fix | Delete

* `edit_app_password`, `delete_app_passwords`, `delete_app_password`,

[33] Fix | Delete

* and `update_https` capabilities.

[34] Fix | Delete

* @since 6.7.0 Added the `edit_block_binding` capability.

[35] Fix | Delete

*

[36] Fix | Delete

* @global array $post_type_meta_caps Used to get post type meta capabilities.

[37] Fix | Delete

*

[38] Fix | Delete

* @param string $cap Capability being checked.

[39] Fix | Delete

* @param int $user_id User ID.

[40] Fix | Delete

* @param mixed ...$args Optional further parameters, typically starting with an object ID.

[41] Fix | Delete

* @return string[] Primitive capabilities required of the user.

[42] Fix | Delete

*/

[43] Fix | Delete

function map_meta_cap( $cap, $user_id, ...$args ) {

[44] Fix | Delete

$caps = array();

[45] Fix | Delete

[46] Fix | Delete

switch ( $cap ) {

[47] Fix | Delete

case 'remove_user':

[48] Fix | Delete

// In multisite the user must be a super admin to remove themselves.

[49] Fix | Delete

if ( isset( $args[0] ) && $user_id === (int) $args[0] && ! is_super_admin( $user_id ) ) {

[50] Fix | Delete

$caps[] = 'do_not_allow';

[51] Fix | Delete

} else {

[52] Fix | Delete

$caps[] = 'remove_users';

[53] Fix | Delete

}

[54] Fix | Delete

break;

[55] Fix | Delete

case 'promote_user':

[56] Fix | Delete

case 'add_users':

[57] Fix | Delete

$caps[] = 'promote_users';

[58] Fix | Delete

break;

[59] Fix | Delete

case 'edit_user':

[60] Fix | Delete

case 'edit_users':

[61] Fix | Delete

// Allow user to edit themselves.

[62] Fix | Delete

if ( 'edit_user' === $cap && isset( $args[0] ) && $user_id === (int) $args[0] ) {

[63] Fix | Delete

break;

[64] Fix | Delete

}

[65] Fix | Delete

[66] Fix | Delete

// In multisite the user must have manage_network_users caps. If editing a super admin, the user must be a super admin.

[67] Fix | Delete

if ( is_multisite() && ( ( ! is_super_admin( $user_id ) && 'edit_user' === $cap && is_super_admin( $args[0] ) ) || ! user_can( $user_id, 'manage_network_users' ) ) ) {

[68] Fix | Delete

$caps[] = 'do_not_allow';

[69] Fix | Delete

} else {

[70] Fix | Delete

$caps[] = 'edit_users'; // edit_user maps to edit_users.

[71] Fix | Delete

}

[72] Fix | Delete

break;

[73] Fix | Delete

case 'delete_post':

[74] Fix | Delete

case 'delete_page':

[75] Fix | Delete

if ( ! isset( $args[0] ) ) {

[76] Fix | Delete

if ( 'delete_post' === $cap ) {

[77] Fix | Delete

/* translators: %s: Capability name. */

[78] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific post.' );

[79] Fix | Delete

} else {

[80] Fix | Delete

/* translators: %s: Capability name. */

[81] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific page.' );

[82] Fix | Delete

}

[83] Fix | Delete

[84] Fix | Delete

_doing_it_wrong(

[85] Fix | Delete

__FUNCTION__,

[86] Fix | Delete

sprintf( $message, '<code>' . $cap . '</code>' ),

[87] Fix | Delete

'6.1.0'

[88] Fix | Delete

);

[89] Fix | Delete

[90] Fix | Delete

$caps[] = 'do_not_allow';

[91] Fix | Delete

break;

[92] Fix | Delete

}

[93] Fix | Delete

[94] Fix | Delete

$post = get_post( $args[0] );

[95] Fix | Delete

if ( ! $post ) {

[96] Fix | Delete

$caps[] = 'do_not_allow';

[97] Fix | Delete

break;

[98] Fix | Delete

}

[99] Fix | Delete

[100] Fix | Delete

if ( 'revision' === $post->post_type ) {

[101] Fix | Delete

$caps[] = 'do_not_allow';

[102] Fix | Delete

break;

[103] Fix | Delete

}

[104] Fix | Delete

[105] Fix | Delete

if ( (int) get_option( 'page_for_posts' ) === $post->ID

[106] Fix | Delete

|| (int) get_option( 'page_on_front' ) === $post->ID

[107] Fix | Delete

) {

[108] Fix | Delete

$caps[] = 'manage_options';

[109] Fix | Delete

break;

[110] Fix | Delete

}

[111] Fix | Delete

[112] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[113] Fix | Delete

if ( ! $post_type ) {

[114] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[115] Fix | Delete

$message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );

[116] Fix | Delete

[117] Fix | Delete

_doing_it_wrong(

[118] Fix | Delete

__FUNCTION__,

[119] Fix | Delete

sprintf(

[120] Fix | Delete

$message,

[121] Fix | Delete

'<code>' . $post->post_type . '</code>',

[122] Fix | Delete

'<code>' . $cap . '</code>'

[123] Fix | Delete

),

[124] Fix | Delete

'4.4.0'

[125] Fix | Delete

);

[126] Fix | Delete

[127] Fix | Delete

$caps[] = 'edit_others_posts';

[128] Fix | Delete

break;

[129] Fix | Delete

}

[130] Fix | Delete

[131] Fix | Delete

if ( ! $post_type->map_meta_cap ) {

[132] Fix | Delete

$caps[] = $post_type->cap->$cap;

[133] Fix | Delete

// Prior to 3.1 we would re-call map_meta_cap here.

[134] Fix | Delete

if ( 'delete_post' === $cap ) {

[135] Fix | Delete

$cap = $post_type->cap->$cap;

[136] Fix | Delete

}

[137] Fix | Delete

break;

[138] Fix | Delete

}

[139] Fix | Delete

[140] Fix | Delete

// If the post author is set and the user is the author...

[141] Fix | Delete

if ( $post->post_author && $user_id === (int) $post->post_author ) {

[142] Fix | Delete

// If the post is published or scheduled...

[143] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[144] Fix | Delete

$caps[] = $post_type->cap->delete_published_posts;

[145] Fix | Delete

} elseif ( 'trash' === $post->post_status ) {

[146] Fix | Delete

$status = get_post_meta( $post->ID, '_wp_trash_meta_status', true );

[147] Fix | Delete

if ( in_array( $status, array( 'publish', 'future' ), true ) ) {

[148] Fix | Delete

$caps[] = $post_type->cap->delete_published_posts;

[149] Fix | Delete

} else {

[150] Fix | Delete

$caps[] = $post_type->cap->delete_posts;

[151] Fix | Delete

}

[152] Fix | Delete

} else {

[153] Fix | Delete

// If the post is draft...

[154] Fix | Delete

$caps[] = $post_type->cap->delete_posts;

[155] Fix | Delete

}

[156] Fix | Delete

} else {

[157] Fix | Delete

// The user is trying to edit someone else's post.

[158] Fix | Delete

$caps[] = $post_type->cap->delete_others_posts;

[159] Fix | Delete

// The post is published or scheduled, extra cap required.

[160] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[161] Fix | Delete

$caps[] = $post_type->cap->delete_published_posts;

[162] Fix | Delete

} elseif ( 'private' === $post->post_status ) {

[163] Fix | Delete

$caps[] = $post_type->cap->delete_private_posts;

[164] Fix | Delete

}

[165] Fix | Delete

}

[166] Fix | Delete

[167] Fix | Delete

/*

[168] Fix | Delete

* Setting the privacy policy page requires `manage_privacy_options`,

[169] Fix | Delete

* so deleting it should require that too.

[170] Fix | Delete

*/

[171] Fix | Delete

if ( (int) get_option( 'wp_page_for_privacy_policy' ) === $post->ID ) {

[172] Fix | Delete

$caps = array_merge( $caps, map_meta_cap( 'manage_privacy_options', $user_id ) );

[173] Fix | Delete

}

[174] Fix | Delete

[175] Fix | Delete

break;

[176] Fix | Delete

/*

[177] Fix | Delete

* edit_post breaks down to edit_posts, edit_published_posts, or

[178] Fix | Delete

* edit_others_posts.

[179] Fix | Delete

*/

[180] Fix | Delete

case 'edit_post':

[181] Fix | Delete

case 'edit_page':

[182] Fix | Delete

if ( ! isset( $args[0] ) ) {

[183] Fix | Delete

if ( 'edit_post' === $cap ) {

[184] Fix | Delete

/* translators: %s: Capability name. */

[185] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific post.' );

[186] Fix | Delete

} else {

[187] Fix | Delete

/* translators: %s: Capability name. */

[188] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific page.' );

[189] Fix | Delete

}

[190] Fix | Delete

[191] Fix | Delete

_doing_it_wrong(

[192] Fix | Delete

__FUNCTION__,

[193] Fix | Delete

sprintf( $message, '<code>' . $cap . '</code>' ),

[194] Fix | Delete

'6.1.0'

[195] Fix | Delete

);

[196] Fix | Delete

[197] Fix | Delete

$caps[] = 'do_not_allow';

[198] Fix | Delete

break;

[199] Fix | Delete

}

[200] Fix | Delete

[201] Fix | Delete

$post = get_post( $args[0] );

[202] Fix | Delete

if ( ! $post ) {

[203] Fix | Delete

$caps[] = 'do_not_allow';

[204] Fix | Delete

break;

[205] Fix | Delete

}

[206] Fix | Delete

[207] Fix | Delete

if ( 'revision' === $post->post_type ) {

[208] Fix | Delete

$post = get_post( $post->post_parent );

[209] Fix | Delete

if ( ! $post ) {

[210] Fix | Delete

$caps[] = 'do_not_allow';

[211] Fix | Delete

break;

[212] Fix | Delete

}

[213] Fix | Delete

}

[214] Fix | Delete

[215] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[216] Fix | Delete

if ( ! $post_type ) {

[217] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[218] Fix | Delete

$message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );

[219] Fix | Delete

[220] Fix | Delete

_doing_it_wrong(

[221] Fix | Delete

__FUNCTION__,

[222] Fix | Delete

sprintf(

[223] Fix | Delete

$message,

[224] Fix | Delete

'<code>' . $post->post_type . '</code>',

[225] Fix | Delete

'<code>' . $cap . '</code>'

[226] Fix | Delete

),

[227] Fix | Delete

'4.4.0'

[228] Fix | Delete

);

[229] Fix | Delete

[230] Fix | Delete

$caps[] = 'edit_others_posts';

[231] Fix | Delete

break;

[232] Fix | Delete

}

[233] Fix | Delete

[234] Fix | Delete

if ( ! $post_type->map_meta_cap ) {

[235] Fix | Delete

$caps[] = $post_type->cap->$cap;

[236] Fix | Delete

// Prior to 3.1 we would re-call map_meta_cap here.

[237] Fix | Delete

if ( 'edit_post' === $cap ) {

[238] Fix | Delete

$cap = $post_type->cap->$cap;

[239] Fix | Delete

}

[240] Fix | Delete

break;

[241] Fix | Delete

}

[242] Fix | Delete

[243] Fix | Delete

// If the post author is set and the user is the author...

[244] Fix | Delete

if ( $post->post_author && $user_id === (int) $post->post_author ) {

[245] Fix | Delete

// If the post is published or scheduled...

[246] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[247] Fix | Delete

$caps[] = $post_type->cap->edit_published_posts;

[248] Fix | Delete

} elseif ( 'trash' === $post->post_status ) {

[249] Fix | Delete

$status = get_post_meta( $post->ID, '_wp_trash_meta_status', true );

[250] Fix | Delete

if ( in_array( $status, array( 'publish', 'future' ), true ) ) {

[251] Fix | Delete

$caps[] = $post_type->cap->edit_published_posts;

[252] Fix | Delete

} else {

[253] Fix | Delete

$caps[] = $post_type->cap->edit_posts;

[254] Fix | Delete

}

[255] Fix | Delete

} else {

[256] Fix | Delete

// If the post is draft...

[257] Fix | Delete

$caps[] = $post_type->cap->edit_posts;

[258] Fix | Delete

}

[259] Fix | Delete

} else {

[260] Fix | Delete

// The user is trying to edit someone else's post.

[261] Fix | Delete

$caps[] = $post_type->cap->edit_others_posts;

[262] Fix | Delete

// The post is published or scheduled, extra cap required.

[263] Fix | Delete

if ( in_array( $post->post_status, array( 'publish', 'future' ), true ) ) {

[264] Fix | Delete

$caps[] = $post_type->cap->edit_published_posts;

[265] Fix | Delete

} elseif ( 'private' === $post->post_status ) {

[266] Fix | Delete

$caps[] = $post_type->cap->edit_private_posts;

[267] Fix | Delete

}

[268] Fix | Delete

}

[269] Fix | Delete

[270] Fix | Delete

/*

[271] Fix | Delete

* Setting the privacy policy page requires `manage_privacy_options`,

[272] Fix | Delete

* so editing it should require that too.

[273] Fix | Delete

*/

[274] Fix | Delete

if ( (int) get_option( 'wp_page_for_privacy_policy' ) === $post->ID ) {

[275] Fix | Delete

$caps = array_merge( $caps, map_meta_cap( 'manage_privacy_options', $user_id ) );

[276] Fix | Delete

}

[277] Fix | Delete

[278] Fix | Delete

break;

[279] Fix | Delete

case 'read_post':

[280] Fix | Delete

case 'read_page':

[281] Fix | Delete

if ( ! isset( $args[0] ) ) {

[282] Fix | Delete

if ( 'read_post' === $cap ) {

[283] Fix | Delete

/* translators: %s: Capability name. */

[284] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific post.' );

[285] Fix | Delete

} else {

[286] Fix | Delete

/* translators: %s: Capability name. */

[287] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific page.' );

[288] Fix | Delete

}

[289] Fix | Delete

[290] Fix | Delete

_doing_it_wrong(

[291] Fix | Delete

__FUNCTION__,

[292] Fix | Delete

sprintf( $message, '<code>' . $cap . '</code>' ),

[293] Fix | Delete

'6.1.0'

[294] Fix | Delete

);

[295] Fix | Delete

[296] Fix | Delete

$caps[] = 'do_not_allow';

[297] Fix | Delete

break;

[298] Fix | Delete

}

[299] Fix | Delete

[300] Fix | Delete

$post = get_post( $args[0] );

[301] Fix | Delete

if ( ! $post ) {

[302] Fix | Delete

$caps[] = 'do_not_allow';

[303] Fix | Delete

break;

[304] Fix | Delete

}

[305] Fix | Delete

[306] Fix | Delete

if ( 'revision' === $post->post_type ) {

[307] Fix | Delete

$post = get_post( $post->post_parent );

[308] Fix | Delete

if ( ! $post ) {

[309] Fix | Delete

$caps[] = 'do_not_allow';

[310] Fix | Delete

break;

[311] Fix | Delete

}

[312] Fix | Delete

}

[313] Fix | Delete

[314] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[315] Fix | Delete

if ( ! $post_type ) {

[316] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[317] Fix | Delete

$message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );

[318] Fix | Delete

[319] Fix | Delete

_doing_it_wrong(

[320] Fix | Delete

__FUNCTION__,

[321] Fix | Delete

sprintf(

[322] Fix | Delete

$message,

[323] Fix | Delete

'<code>' . $post->post_type . '</code>',

[324] Fix | Delete

'<code>' . $cap . '</code>'

[325] Fix | Delete

),

[326] Fix | Delete

'4.4.0'

[327] Fix | Delete

);

[328] Fix | Delete

[329] Fix | Delete

$caps[] = 'edit_others_posts';

[330] Fix | Delete

break;

[331] Fix | Delete

}

[332] Fix | Delete

[333] Fix | Delete

if ( ! $post_type->map_meta_cap ) {

[334] Fix | Delete

$caps[] = $post_type->cap->$cap;

[335] Fix | Delete

// Prior to 3.1 we would re-call map_meta_cap here.

[336] Fix | Delete

if ( 'read_post' === $cap ) {

[337] Fix | Delete

$cap = $post_type->cap->$cap;

[338] Fix | Delete

}

[339] Fix | Delete

break;

[340] Fix | Delete

}

[341] Fix | Delete

[342] Fix | Delete

$status_obj = get_post_status_object( get_post_status( $post ) );

[343] Fix | Delete

if ( ! $status_obj ) {

[344] Fix | Delete

/* translators: 1: Post status, 2: Capability name. */

[345] Fix | Delete

$message = __( 'The post status %1$s is not registered, so it may not be reliable to check the capability %2$s against a post with that status.' );

[346] Fix | Delete

[347] Fix | Delete

_doing_it_wrong(

[348] Fix | Delete

__FUNCTION__,

[349] Fix | Delete

sprintf(

[350] Fix | Delete

$message,

[351] Fix | Delete

'<code>' . get_post_status( $post ) . '</code>',

[352] Fix | Delete

'<code>' . $cap . '</code>'

[353] Fix | Delete

),

[354] Fix | Delete

'5.4.0'

[355] Fix | Delete

);

[356] Fix | Delete

[357] Fix | Delete

$caps[] = 'edit_others_posts';

[358] Fix | Delete

break;

[359] Fix | Delete

}

[360] Fix | Delete

[361] Fix | Delete

if ( $status_obj->public ) {

[362] Fix | Delete

$caps[] = $post_type->cap->read;

[363] Fix | Delete

break;

[364] Fix | Delete

}

[365] Fix | Delete

[366] Fix | Delete

if ( $post->post_author && $user_id === (int) $post->post_author ) {

[367] Fix | Delete

$caps[] = $post_type->cap->read;

[368] Fix | Delete

} elseif ( $status_obj->private ) {

[369] Fix | Delete

$caps[] = $post_type->cap->read_private_posts;

[370] Fix | Delete

} else {

[371] Fix | Delete

$caps = map_meta_cap( 'edit_post', $user_id, $post->ID );

[372] Fix | Delete

}

[373] Fix | Delete

break;

[374] Fix | Delete

case 'publish_post':

[375] Fix | Delete

if ( ! isset( $args[0] ) ) {

[376] Fix | Delete

/* translators: %s: Capability name. */

[377] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific post.' );

[378] Fix | Delete

[379] Fix | Delete

_doing_it_wrong(

[380] Fix | Delete

__FUNCTION__,

[381] Fix | Delete

sprintf( $message, '<code>' . $cap . '</code>' ),

[382] Fix | Delete

'6.1.0'

[383] Fix | Delete

);

[384] Fix | Delete

[385] Fix | Delete

$caps[] = 'do_not_allow';

[386] Fix | Delete

break;

[387] Fix | Delete

}

[388] Fix | Delete

[389] Fix | Delete

$post = get_post( $args[0] );

[390] Fix | Delete

if ( ! $post ) {

[391] Fix | Delete

$caps[] = 'do_not_allow';

[392] Fix | Delete

break;

[393] Fix | Delete

}

[394] Fix | Delete

[395] Fix | Delete

$post_type = get_post_type_object( $post->post_type );

[396] Fix | Delete

if ( ! $post_type ) {

[397] Fix | Delete

/* translators: 1: Post type, 2: Capability name. */

[398] Fix | Delete

$message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' );

[399] Fix | Delete

[400] Fix | Delete

_doing_it_wrong(

[401] Fix | Delete

__FUNCTION__,

[402] Fix | Delete

sprintf(

[403] Fix | Delete

$message,

[404] Fix | Delete

'<code>' . $post->post_type . '</code>',

[405] Fix | Delete

'<code>' . $cap . '</code>'

[406] Fix | Delete

),

[407] Fix | Delete

'4.4.0'

[408] Fix | Delete

);

[409] Fix | Delete

[410] Fix | Delete

$caps[] = 'edit_others_posts';

[411] Fix | Delete

break;

[412] Fix | Delete

}

[413] Fix | Delete

[414] Fix | Delete

$caps[] = $post_type->cap->publish_posts;

[415] Fix | Delete

break;

[416] Fix | Delete

case 'edit_post_meta':

[417] Fix | Delete

case 'delete_post_meta':

[418] Fix | Delete

case 'add_post_meta':

[419] Fix | Delete

case 'edit_comment_meta':

[420] Fix | Delete

case 'delete_comment_meta':

[421] Fix | Delete

case 'add_comment_meta':

[422] Fix | Delete

case 'edit_term_meta':

[423] Fix | Delete

case 'delete_term_meta':

[424] Fix | Delete

case 'add_term_meta':

[425] Fix | Delete

case 'edit_user_meta':

[426] Fix | Delete

case 'delete_user_meta':

[427] Fix | Delete

case 'add_user_meta':

[428] Fix | Delete

$object_type = explode( '_', $cap )[1];

[429] Fix | Delete

[430] Fix | Delete

if ( ! isset( $args[0] ) ) {

[431] Fix | Delete

if ( 'post' === $object_type ) {

[432] Fix | Delete

/* translators: %s: Capability name. */

[433] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific post.' );

[434] Fix | Delete

} elseif ( 'comment' === $object_type ) {

[435] Fix | Delete

/* translators: %s: Capability name. */

[436] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific comment.' );

[437] Fix | Delete

} elseif ( 'term' === $object_type ) {

[438] Fix | Delete

/* translators: %s: Capability name. */

[439] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific term.' );

[440] Fix | Delete

} else {

[441] Fix | Delete

/* translators: %s: Capability name. */

[442] Fix | Delete

$message = __( 'When checking for the %s capability, you must always check it against a specific user.' );

[443] Fix | Delete

}

[444] Fix | Delete

[445] Fix | Delete

_doing_it_wrong(

[446] Fix | Delete

__FUNCTION__,

[447] Fix | Delete

sprintf( $message, '<code>' . $cap . '</code>' ),

[448] Fix | Delete

'6.1.0'

[449] Fix | Delete

);

[450] Fix | Delete

[451] Fix | Delete

$caps[] = 'do_not_allow';

[452] Fix | Delete

break;

[453] Fix | Delete

}

[454] Fix | Delete

[455] Fix | Delete

$object_id = (int) $args[0];

[456] Fix | Delete

[457] Fix | Delete

$object_subtype = get_object_subtype( $object_type, $object_id );

[458] Fix | Delete

[459] Fix | Delete

if ( empty( $object_subtype ) ) {

[460] Fix | Delete

$caps[] = 'do_not_allow';

[461] Fix | Delete

break;

[462] Fix | Delete

}

[463] Fix | Delete

[464] Fix | Delete

$caps = map_meta_cap( "edit_{$object_type}", $user_id, $object_id );

[465] Fix | Delete

[466] Fix | Delete

$meta_key = isset( $args[1] ) ? $args[1] : false;

[467] Fix | Delete

[468] Fix | Delete

if ( $meta_key ) {

[469] Fix | Delete

$allowed = ! is_protected_meta( $meta_key, $object_type );

[470] Fix | Delete

[471] Fix | Delete

if ( ! empty( $object_subtype ) && has_filter( "auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype}" ) ) {

[472] Fix | Delete

[473] Fix | Delete

/**

[474] Fix | Delete

* Filters whether the user is allowed to edit a specific meta key of a specific object type and subtype.

[475] Fix | Delete

*

[476] Fix | Delete

* The dynamic portions of the hook name, `$object_type`, `$meta_key`,

[477] Fix | Delete

* and `$object_subtype`, refer to the metadata object type (comment, post, term or user),

[478] Fix | Delete

* the meta key value, and the object subtype respectively.

[479] Fix | Delete

*

[480] Fix | Delete

* @since 4.9.8

[481] Fix | Delete

*

[482] Fix | Delete

* @param bool $allowed Whether the user can add the object meta. Default false.

[483] Fix | Delete

* @param string $meta_key The meta key.

[484] Fix | Delete

* @param int $object_id Object ID.

[485] Fix | Delete

* @param int $user_id User ID.

[486] Fix | Delete

* @param string $cap Capability name.

[487] Fix | Delete

* @param string[] $caps Array of the user's capabilities.

[488] Fix | Delete

*/

[489] Fix | Delete

$allowed = apply_filters( "auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype}", $allowed, $meta_key, $object_id, $user_id, $cap, $caps );

[490] Fix | Delete

} else {

[491] Fix | Delete

[492] Fix | Delete

/**

[493] Fix | Delete

* Filters whether the user is allowed to edit a specific meta key of a specific object type.

[494] Fix | Delete

*

[495] Fix | Delete

* Return true to have the mapped meta caps from `edit_{$object_type}` apply.

[496] Fix | Delete

*

[497] Fix | Delete

* The dynamic portion of the hook name, `$object_type` refers to the object type being filtered.

[498] Fix | Delete

* The dynamic portion of the hook name, `$meta_key`, refers to the meta key passed to map_meta_cap().

[499] Fix | Delete