Advanced Access Manager - Version 5.9.2.1

Version Description

  • Fixed several bugs that are related to post, page or custom post type editing
Download this release

Release Info

Developer vasyltech
Plugin Icon 128x128 Advanced Access Manager
Version 5.9.2.1
Comparing to
See all releases

Code changes from version 5.9.2 to 5.9.2.1

Files changed (4) hide show
  1. Application/Frontend/Manager.php +3 -1
  2. Application/Shared/Manager.php +72 -30
  3. aam.php +1 -1
  4. readme.txt +4 -1
Application/Frontend/Manager.php CHANGED
@@ -37,7 +37,9 @@ class AAM_Frontend_Manager {
37
  }
38
 
39
  //manage AAM shortcode
40
- add_shortcode('aam', array($this, 'processShortcode'));
 
 
41
 
42
  //cache clearing hook
43
  add_action('aam-clear-cache-action', 'AAM_Core_API::clearCache');
37
  }
38
 
39
  //manage AAM shortcode
40
+ if (AAM_Core_Config::get('core.processShortcodes', true)) {
41
+ add_shortcode('aam', array($this, 'processShortcode'));
42
+ }
43
 
44
  //cache clearing hook
45
  add_action('aam-clear-cache-action', 'AAM_Core_API::clearCache');
Application/Shared/Manager.php CHANGED
@@ -24,6 +24,22 @@ class AAM_Shared_Manager {
24
  */
25
  private static $_instance = null;
26
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
27
  /**
28
  * Constructor
29
  *
@@ -127,7 +143,7 @@ class AAM_Shared_Manager {
127
  public function registerPostType($type, $object) {
128
  if (is_a($object, 'WP_Post_Type')) { // Work only with WP 4.6.0 or higher
129
  foreach($object->cap as $type => $capability) {
130
- if (in_array($type, array('edit_post', 'delete_post', 'read_post'), true)) {
131
  $object->cap->{$type} = "aam-{$type}-{$capability}";
132
  }
133
  }
@@ -452,7 +468,7 @@ class AAM_Shared_Manager {
452
  * @access public
453
  */
454
  public function mapMetaCaps($caps, $cap, $user_id, $args) {
455
- global $post;
456
 
457
  $objectId = (isset($args[0]) ? $args[0] : null);
458
 
@@ -461,6 +477,9 @@ class AAM_Shared_Manager {
461
  if (strpos($capability, 'aam-') === 0) {
462
  $parts = explode('-', $capability);
463
  $capability = $parts[2];
 
 
 
464
  }
465
 
466
  if (in_array($capability, AAM_Backend_Feature_Main_Capability::$groups['aam'], true)) {
@@ -471,7 +490,12 @@ class AAM_Shared_Manager {
471
  }
472
  }
473
 
474
- $caps[$i] = $capability;
 
 
 
 
 
475
  }
476
 
477
  switch($cap) {
@@ -527,7 +551,11 @@ class AAM_Shared_Manager {
527
 
528
  default:
529
  if (strpos($cap, 'aam-') === 0) {
530
- $caps = $this->checkPostTypePermission($caps, $cap, $objectId);
 
 
 
 
531
  } else {
532
  $caps = apply_filters('aam-map-meta-caps-filter', $caps, $cap, $args);
533
  }
@@ -548,7 +576,9 @@ class AAM_Shared_Manager {
548
  *
549
  * @access protected
550
  */
551
- protected function checkPostTypePermission($caps, $cap, $id = null) {
 
 
552
  // Expecting to have:
553
  // [0] === aam
554
  // [1] === WP_Post_Type->cap key
@@ -557,28 +587,36 @@ class AAM_Shared_Manager {
557
 
558
  // Build the argument array for the current_user_can
559
  $args = array($parts[2]);
560
- if (!is_null($id)) {
561
- $args[] = $id;
562
  }
563
 
564
- // NOTE! DO NOT FORGET TO UPDATE REGISTERED_POST_TYPE if new capability is
565
- // added
566
  if (call_user_func_array('current_user_can', $args)) {
567
- switch($parts[1]) {
568
- case 'edit_post':
569
- $caps = $this->authorizePostEdit($caps, $id);
570
- break;
571
-
572
- case 'read_post':
573
- $caps = $this->authorizePostRead($caps, $id);
574
- break;
575
-
576
- case 'delete_post':
577
- $caps = $this->authorizePostDelete($caps, $id);
578
- break;
579
-
580
- default:
581
- break;
 
 
 
 
 
 
 
 
 
 
582
  }
583
  } else {
584
  $caps[] = 'do_not_allow';
@@ -733,13 +771,14 @@ class AAM_Shared_Manager {
733
  * Check if current user is allowed to edit post
734
  *
735
  * @param array $caps
736
- * @param int $id
737
  *
738
  * @return array
739
  *
740
  * @access protected
741
  */
742
- protected function authorizePostEdit($caps, $id) {
 
743
  $object = AAM::getUser()->getObject('post', $id);
744
  $draft = $object->post_status === 'auto-draft';
745
  $area = AAM_Core_Api_Area::get();
@@ -761,7 +800,8 @@ class AAM_Shared_Manager {
761
  *
762
  * @access protected
763
  */
764
- protected function authorizePostDelete($caps, $id) {
 
765
  $object = AAM::getUser()->getObject('post', $id);
766
  $area = AAM_Core_Api_Area::get();
767
 
@@ -783,7 +823,8 @@ class AAM_Shared_Manager {
783
  * @access protected
784
  * @global WP_Post $post
785
  */
786
- protected function authorizePublishPost($caps, $id) {
 
787
  $object = AAM::getUser()->getObject('post', $id);
788
  $area = AAM_Core_Api_Area::get();
789
 
@@ -805,8 +846,9 @@ class AAM_Shared_Manager {
805
  * @access protected
806
  * @global WP_Post $post
807
  */
808
- protected function authorizePostRead($caps, $id) {
809
- $object = AAM::getUser()->getObject('post', $id);
 
810
  $area = AAM_Core_Api_Area::get();
811
 
812
  if (!$object->allowed($area . '.read')) {
24
  */
25
  private static $_instance = null;
26
 
27
+ /**
28
+ * Undocumented variable
29
+ *
30
+ * @var array
31
+ */
32
+ protected $primitiveCaps = array(
33
+ 'edit_post', 'delete_post', 'read_post', 'publish_posts'
34
+ );
35
+
36
+ /**
37
+ * Undocumented variable
38
+ *
39
+ * @var boolean
40
+ */
41
+ protected $skipMetaCheck = false;
42
+
43
  /**
44
  * Constructor
45
  *
143
  public function registerPostType($type, $object) {
144
  if (is_a($object, 'WP_Post_Type')) { // Work only with WP 4.6.0 or higher
145
  foreach($object->cap as $type => $capability) {
146
+ if (in_array($type, $this->primitiveCaps, true)) {
147
  $object->cap->{$type} = "aam-{$type}-{$capability}";
148
  }
149
  }
468
  * @access public
469
  */
470
  public function mapMetaCaps($caps, $cap, $user_id, $args) {
471
+ global $post, $screen;
472
 
473
  $objectId = (isset($args[0]) ? $args[0] : null);
474
 
477
  if (strpos($capability, 'aam-') === 0) {
478
  $parts = explode('-', $capability);
479
  $capability = $parts[2];
480
+ $primitive = $parts[1];
481
+ } else {
482
+ $primitive = null;
483
  }
484
 
485
  if (in_array($capability, AAM_Backend_Feature_Main_Capability::$groups['aam'], true)) {
490
  }
491
  }
492
 
493
+ // If capability is primitive - then do not include it in the list of meta caps
494
+ if (in_array($primitive, $this->primitiveCaps, true)) {
495
+ unset($caps[$i]);
496
+ } else {
497
+ $caps[$i] = $capability;
498
+ }
499
  }
500
 
501
  switch($cap) {
551
 
552
  default:
553
  if (strpos($cap, 'aam-') === 0) {
554
+ if (!$this->skipMetaCheck) {
555
+ $this->skipMetaCheck = true;
556
+ $caps = $this->checkPostTypePermission($caps, $cap, $objectId);
557
+ $this->skipMetaCheck = false;
558
+ }
559
  } else {
560
  $caps = apply_filters('aam-map-meta-caps-filter', $caps, $cap, $args);
561
  }
576
  *
577
  * @access protected
578
  */
579
+ protected function checkPostTypePermission($caps, $cap, $object = null) {
580
+ global $post;
581
+
582
  // Expecting to have:
583
  // [0] === aam
584
  // [1] === WP_Post_Type->cap key
587
 
588
  // Build the argument array for the current_user_can
589
  $args = array($parts[2]);
590
+ if (!is_null($object)) {
591
+ $args[] = $object;
592
  }
593
 
 
 
594
  if (call_user_func_array('current_user_can', $args)) {
595
+ if ($parts[1] !== $parts[2]) {
596
+ switch($parts[1]) {
597
+ case 'edit_post':
598
+ $caps = $this->authorizePostEdit($caps, $object);
599
+ break;
600
+
601
+ case 'read_post':
602
+ $caps = $this->authorizePostRead($caps, $object);
603
+ break;
604
+
605
+ case 'delete_post':
606
+ $caps = $this->authorizePostDelete($caps, $object);
607
+ break;
608
+
609
+ case 'publish_posts':
610
+ // $post->ID is mandatory as 'publish_post' does not pass the
611
+ // current post
612
+ if (is_a($post, 'WP_Post')) {
613
+ $caps = $this->authorizePublishPost($caps, $post->ID);
614
+ }
615
+ break;
616
+
617
+ default:
618
+ break;
619
+ }
620
  }
621
  } else {
622
  $caps[] = 'do_not_allow';
771
  * Check if current user is allowed to edit post
772
  *
773
  * @param array $caps
774
+ * @param int $obj
775
  *
776
  * @return array
777
  *
778
  * @access protected
779
  */
780
+ protected function authorizePostEdit($caps, $obj) {
781
+ $id = (is_a($obj, 'WP_Post') ? $obj->ID : $obj);
782
  $object = AAM::getUser()->getObject('post', $id);
783
  $draft = $object->post_status === 'auto-draft';
784
  $area = AAM_Core_Api_Area::get();
800
  *
801
  * @access protected
802
  */
803
+ protected function authorizePostDelete($caps, $obj) {
804
+ $id = (is_a($obj, 'WP_Post') ? $obj->ID : $obj);
805
  $object = AAM::getUser()->getObject('post', $id);
806
  $area = AAM_Core_Api_Area::get();
807
 
823
  * @access protected
824
  * @global WP_Post $post
825
  */
826
+ protected function authorizePublishPost($caps, $obj) {
827
+ $id = (is_a($obj, 'WP_Post') ? $obj->ID : $obj);
828
  $object = AAM::getUser()->getObject('post', $id);
829
  $area = AAM_Core_Api_Area::get();
830
 
846
  * @access protected
847
  * @global WP_Post $post
848
  */
849
+ protected function authorizePostRead($caps, $obj) {
850
+ $id = (is_a($obj, 'WP_Post') ? $obj->ID : $obj);
851
+ $object = AAM::getUser()->getObject('post', $obj);
852
  $area = AAM_Core_Api_Area::get();
853
 
854
  if (!$object->allowed($area . '.read')) {
aam.php CHANGED
@@ -3,7 +3,7 @@
3
  /**
4
  * Plugin Name: Advanced Access Manager
5
  * Description: All you need to manage access to your WordPress website
6
- * Version: 5.9.2
7
  * Author: Vasyl Martyniuk <vasyl@vasyltech.com>
8
  * Author URI: https://vasyltech.com
9
  *
3
  /**
4
  * Plugin Name: Advanced Access Manager
5
  * Description: All you need to manage access to your WordPress website
6
+ * Version: 5.9.2.1
7
  * Author: Vasyl Martyniuk <vasyl@vasyltech.com>
8
  * Author URI: https://vasyltech.com
9
  *
readme.txt CHANGED
@@ -3,7 +3,7 @@ Contributors: vasyltech
3
  Tags: access control, membership, backend menu, user role, restricted content, security, jwt
4
  Requires at least: 4.0
5
  Tested up to: 5.1
6
- Stable tag: 5.9.2
7
 
8
  All you need to manage access to you WordPress websites on frontend, backend and API levels for any role, user or visitors.
9
 
@@ -80,6 +80,9 @@ https://www.youtube.com/watch?v=mj5Xa_Wc16Y
80
 
81
  == Changelog ==
82
 
 
 
 
83
  = 5.9.2 =
84
  * Fixed the bug with Access Policy access control
85
  * Fixed the bug with Access Policy tab shows only 10 last Policies
3
  Tags: access control, membership, backend menu, user role, restricted content, security, jwt
4
  Requires at least: 4.0
5
  Tested up to: 5.1
6
+ Stable tag: 5.9.2.1
7
 
8
  All you need to manage access to you WordPress websites on frontend, backend and API levels for any role, user or visitors.
9
 
80
 
81
  == Changelog ==
82
 
83
+ = 5.9.2.1 =
84
+ * Fixed several bugs that are related to post, page or custom post type editing
85
+
86
  = 5.9.2 =
87
  * Fixed the bug with Access Policy access control
88
  * Fixed the bug with Access Policy tab shows only 10 last Policies