A HitchHackers guide through WordPress

Source code

function map_meta_cap( $cap, $user_id ) {

	$args = array_slice( func_get_args(), 2 );

	$caps = array();



	switch ( $cap ) {

	case 'remove_user':

		$caps[] = 'remove_users';

		break;

	case 'promote_user':

		$caps[] = 'promote_users';

		break;

	case 'edit_user':

		// Allow user to edit itself

		if ( isset( $args[0] ) && $user_id == $args[0] )

			break;

		// Fall through

	case 'edit_users':

		// If multisite these caps are allowed only for super admins.

		if ( is_multisite() && !is_super_admin( $user_id ) )

			$caps[] = 'do_not_allow';

		else

			$caps[] = 'edit_users'; // Explicit due to primitive fall through

		break;

	case 'delete_post':

	case 'delete_page':

		$author_data = get_userdata( $user_id );

		$post = get_post( $args[0] );



		if ( 'revision' == $post->post_type ) {

			$post = get_post( $post->post_parent );

		}



		$post_type = get_post_type_object( $post->post_type );



		if ( ! $post_type->map_meta_cap ) {

			$caps[] = $post_type->cap->$cap;

			// Prior to 3.1 we would re-call map_meta_cap here.

			if ( 'delete_post' == $cap )

				$cap = $post_type->cap->$cap;

			break;

		}



		if ( '' != $post->post_author ) {

			$post_author_data = get_userdata( $post->post_author );

		} else {

			// No author set yet, so default to current user for cap checks.

			$post_author_data = $author_data;

		}



		// If the user is the author...

		if ( is_object( $post_author_data ) && $user_id == $post_author_data->ID ) {

			// If the post is published...

			if ( 'publish' == $post->post_status ) {

				$caps[] = $post_type->cap->delete_published_posts;

			} elseif ( 'trash' == $post->post_status ) {

				if ('publish' == get_post_meta($post->ID, '_wp_trash_meta_status', true) )

					$caps[] = $post_type->cap->delete_published_posts;

			} else {

				// If the post is draft...

				$caps[] = $post_type->cap->delete_posts;

			}

		} else {

			// The user is trying to edit someone else's post.

			$caps[] = $post_type->cap->delete_others_posts;

			// The post is published, extra cap required.

			if ( 'publish' == $post->post_status )

				$caps[] = $post_type->cap->delete_published_posts;

			elseif ( 'private' == $post->post_status )

				$caps[] = $post_type->cap->delete_private_posts;

		}

		break;

		// edit_post breaks down to edit_posts, edit_published_posts, or

		// edit_others_posts

	case 'edit_post':

	case 'edit_page':

		$author_data = get_userdata( $user_id );

		$post = get_post( $args[0] );



		if ( 'revision' == $post->post_type ) {

			$post = get_post( $post->post_parent );

		}



		$post_type = get_post_type_object( $post->post_type );



		if ( ! $post_type->map_meta_cap ) {

			$caps[] = $post_type->cap->$cap;

			// Prior to 3.1 we would re-call map_meta_cap here.

			if ( 'edit_post' == $cap )

				$cap = $post_type->cap->$cap;

			break;

		}



		if ( '' != $post->post_author ) {

			$post_author_data = get_userdata( $post->post_author );

		} else {

			// No author set yet, so default to current user for cap checks.

			$post_author_data = $author_data;

		}



		//echo "current user id : $user_id, post author id: " . $post_author_data->ID . "<br />";

		// If the user is the author...

		if ( is_object( $post_author_data ) && $user_id == $post_author_data->ID ) {

			// If the post is published...

			if ( 'publish' == $post->post_status ) {

				$caps[] = $post_type->cap->edit_published_posts;

			} elseif ( 'trash' == $post->post_status ) {

				if ('publish' == get_post_meta($post->ID, '_wp_trash_meta_status', true) )

					$caps[] = $post_type->cap->edit_published_posts;

			} else {

				// If the post is draft...

				$caps[] = $post_type->cap->edit_posts;

			}

		} else {

			// The user is trying to edit someone else's post.

			$caps[] = $post_type->cap->edit_others_posts;

			// The post is published, extra cap required.

			if ( 'publish' == $post->post_status )

				$caps[] = $post_type->cap->edit_published_posts;

			elseif ( 'private' == $post->post_status )

				$caps[] = $post_type->cap->edit_private_posts;

		}

		break;

	case 'read_post':

	case 'read_page':

		$author_data = get_userdata( $user_id );

		$post = get_post( $args[0] );



		if ( 'revision' == $post->post_type ) {

			$post = get_post( $post->post_parent );

		}



		$post_type = get_post_type_object( $post->post_type );



		if ( ! $post_type->map_meta_cap ) {

			$caps[] = $post_type->cap->$cap;

			// Prior to 3.1 we would re-call map_meta_cap here.

			if ( 'read_post' == $cap )

				$cap = $post_type->cap->$cap;

			break;

		}



		if ( 'private' != $post->post_status ) {

			$caps[] = $post_type->cap->read;

			break;

		}



		if ( '' != $post->post_author ) {

			$post_author_data = get_userdata( $post->post_author );

		} else {

			// No author set yet, so default to current user for cap checks.

			$post_author_data = $author_data;

		}



		if ( is_object( $post_author_data ) && $user_id == $post_author_data->ID )

			$caps[] = $post_type->cap->read;

		else

			$caps[] = $post_type->cap->read_private_posts;

		break;

	case 'edit_post_meta':

	case 'delete_post_meta':

	case 'add_post_meta':

		$post = get_post( $args[0] );

		$post_type_object = get_post_type_object( $post->post_type );

		$caps = map_meta_cap( $post_type_object->cap->edit_post, $user_id, $post->ID );



		$meta_key = isset( $args[ 1 ] ) ? $args[ 1 ] : false;



		if ( $meta_key && has_filter( "auth_post_meta_{$meta_key}" ) ) {

			$allowed = apply_filters( "auth_post_meta_{$meta_key}", false, $meta_key, $post->ID, $user_id, $cap, $caps );

			if ( ! $allowed )

				$caps[] = $cap;

		} elseif ( $meta_key && is_protected_meta( $meta_key, 'post' ) ) {