← All changes | core/settings/page/manager.php +9 -24 4.1.4 → 3.20.2 View file →

		@@ -97,13 +97,13 @@
97	97	public function ajax_before_save_settings( array $data, $id ) {
98	98	$post = get_post( $id );
99	99
100	100	if ( empty( $post ) ) {
101		- throw new \Exception( 'Invalid post.', Exceptions::NOT_FOUND ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
	101	+ throw new \Exception( 'Invalid post.', Exceptions::NOT_FOUND );
102	102	}
103	103
104	104	if ( ! Utils::is_wp_cli() && ! current_user_can( 'edit_post', $id ) ) {
105		- throw new \Exception( 'Access denied.', Exceptions::FORBIDDEN ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
	105	+ throw new \Exception( 'Access denied.', Exceptions::FORBIDDEN );
106	106	}
107	107
108	108	// Avoid save empty post title.
109	109	if ( ! empty( $data['post_title'] ) ) {
		@@ -128,9 +128,9 @@
128	128	}
129	129
130	130	wp_update_post( $post );
131	131
132		- // Check updated status.
	132	+ // Check updated status
133	133	if ( Document::STATUS_PUBLISH === get_post_status( $id ) ) {
134	134	$autosave = wp_get_post_autosave( $post->ID );
135	135	if ( $autosave ) {
136	136	wp_delete_post_revision( $autosave->ID );
		@@ -137,13 +137,8 @@
137	137	}
138	138	}
139	139
140	140	if ( isset( $data['post_featured_image'] ) && post_type_supports( $post->post_type, 'thumbnail' ) ) {
141		- // Check if the user is at least an Author before allowing them to modify the thumbnail.
142		- if ( ! current_user_can( 'publish_posts' ) ) {
143		- throw new \Exception( 'You do not have permission to modify the featured image.', Exceptions::FORBIDDEN ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
144		- }
145		-
146	141	if ( empty( $data['post_featured_image']['id'] ) ) {
147	142	delete_post_thumbnail( $post->ID );
148	143	} else {
149	144	set_post_thumbnail( $post->ID, $data['post_featured_image']['id'] );
		@@ -180,9 +175,10 @@
180	175	<div class="elementor-panel-navigation">
181	176	<# _.each( tabs, function( tabTitle, tabSlug ) {
182	177	$e.bc.ensureTab( 'panel/page-settings', tabSlug ); #>
183	178	<button class="elementor-component-tab elementor-panel-navigation-tab elementor-tab-control-{{ tabSlug }}" data-tab="{{ tabSlug }}">
184		- <span>{{{ tabTitle }}}</span>
	179	+ <?php /* TODO: raplace `<a>` tag with `<span>` tag in Elementor 3.14.0 */ ?>
	180	+ <a>{{{ tabTitle }}}</a>
185	181	</button>
186	182	<# } ); #>
187	183	</div>
188	184	<# } #>
		@@ -328,14 +324,17 @@
328	324
329	325	/**
330	326	* @since 2.0.0
331	327	* @access public
	328	+ *
	329	+ * @param $post_id
	330	+ * @param $status
332	331	*/
333	332	public function save_post_status( $post_id, $status ) {
334	333	$parent_id = wp_is_post_revision( $post_id );
335	334
336	335	if ( $parent_id ) {
337		- // Don't update revisions post-status.
	336	+ // Don't update revisions post-status
338	337	return;
339	338	}
340	339
341	340	$parent_id = $post_id;
		@@ -343,14 +342,8 @@
343	342	$post = get_post( $parent_id );
344	343
345	344	$allowed_post_statuses = get_post_statuses();
346	345
347		- if ( $this->is_contributor_user() && $this->has_invalid_post_status_for_contributor( $status ) ) {
348		- // If the status is not allowed, set it to 'pending' by default.
349		- $status = 'pending';
350		- $post->post_status = $status;
351		- }
352		-
353	346	if ( isset( $allowed_post_statuses[ $status ] ) ) {
354	347	$post_type_object = get_post_type_object( $post->post_type );
355	348	if ( 'publish' !== $status || current_user_can( $post_type_object->cap->publish_posts ) ) {
356	349	$post->post_status = $status;
		@@ -357,14 +350,6 @@
357	350	}
358	351	}
359	352
360	353	wp_update_post( $post );
361		- }
362		-
363		- private function is_contributor_user(): bool {
364		- return current_user_can( 'edit_posts' ) && ! current_user_can( 'publish_posts' );
365		- }
366		-
367		- private function has_invalid_post_status_for_contributor( $status ): bool {
368		- return 'draft' !== $status && 'pending' !== $status;
369	354	}
370	355	}