← All changes | core/settings/page/manager.php +11 -7 4.1.2 → 3.26.2 View file →

		@@ -97,13 +97,13 @@
97	97	public function ajax_before_save_settings( array $data, $id ) {
98	98	$post = get_post( $id );
99	99
100	100	if ( empty( $post ) ) {
101		- throw new \Exception( 'Invalid post.', Exceptions::NOT_FOUND ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
	101	+ throw new \Exception( 'Invalid post.', Exceptions::NOT_FOUND );
102	102	}
103	103
104	104	if ( ! Utils::is_wp_cli() && ! current_user_can( 'edit_post', $id ) ) {
105		- throw new \Exception( 'Access denied.', Exceptions::FORBIDDEN ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
	105	+ throw new \Exception( 'Access denied.', Exceptions::FORBIDDEN );
106	106	}
107	107
108	108	// Avoid save empty post title.
109	109	if ( ! empty( $data['post_title'] ) ) {
		@@ -128,9 +128,9 @@
128	128	}
129	129
130	130	wp_update_post( $post );
131	131
132		- // Check updated status.
	132	+ // Check updated status
133	133	if ( Document::STATUS_PUBLISH === get_post_status( $id ) ) {
134	134	$autosave = wp_get_post_autosave( $post->ID );
135	135	if ( $autosave ) {
136	136	wp_delete_post_revision( $autosave->ID );
		@@ -137,11 +137,11 @@
137	137	}
138	138	}
139	139
140	140	if ( isset( $data['post_featured_image'] ) && post_type_supports( $post->post_type, 'thumbnail' ) ) {
141		- // Check if the user is at least an Author before allowing them to modify the thumbnail.
	141	+ // Check if the user is at least an Author before allowing them to modify the thumbnail
142	142	if ( ! current_user_can( 'publish_posts' ) ) {
143		- throw new \Exception( 'You do not have permission to modify the featured image.', Exceptions::FORBIDDEN ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped
	143	+ throw new \Exception( 'You do not have permission to modify the featured image.', Exceptions::FORBIDDEN );
144	144	}
145	145
146	146	if ( empty( $data['post_featured_image']['id'] ) ) {
147	147	delete_post_thumbnail( $post->ID );
		@@ -328,14 +328,17 @@
328	328
329	329	/**
330	330	* @since 2.0.0
331	331	* @access public
	332	+ *
	333	+ * @param $post_id
	334	+ * @param $status
332	335	*/
333	336	public function save_post_status( $post_id, $status ) {
334	337	$parent_id = wp_is_post_revision( $post_id );
335	338
336	339	if ( $parent_id ) {
337		- // Don't update revisions post-status.
	340	+ // Don't update revisions post-status
338	341	return;
339	342	}
340	343
341	344	$parent_id = $post_id;
		@@ -344,9 +347,9 @@
344	347
345	348	$allowed_post_statuses = get_post_statuses();
346	349
347	350	if ( $this->is_contributor_user() && $this->has_invalid_post_status_for_contributor( $status ) ) {
348		- // If the status is not allowed, set it to 'pending' by default.
	351	+ // If the status is not allowed, set it to 'pending' by default
349	352	$status = 'pending';
350	353	$post->post_status = $status;
351	354	}
352	355
		@@ -366,5 +369,6 @@
366	369
367	370	private function has_invalid_post_status_for_contributor( $status ): bool {
368	371	return 'draft' !== $status && 'pending' !== $status;
369	372	}
	373	+
370	374	}