Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: global library edits check private and scheduled pages, name the backup on failure (P8a, P14)

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
janniclas.loosen
2026-09-27 01:25:16 +02:00
co-authored by Claude Opus 5.5
parent d66ad36c2e
commit 520a639411
7 changed files with 332 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Divi/Library/GlobalEdits.php
+84 -21
View File
@@ -27,7 +27,8 @@ defined('ABSPATH') || exit;
* save scope is GlobalItem (site-wide cache) and, when revisions are off for the entry, a backup
* copy is made first – the revision itself is DiviSaver's restore point, as for every page.
* Confirm stays honour-based (ruling P9, like D10). A confirmed edit is refused while the user may
* not edit_post one of the published pages that show the entry (ruling P8, stricter than Divi).
* not edit_post one of the published, private or scheduled posts that show the entry (rulings
* P8/P8a, stricter than Divi); the dry run names them already (blocked_ids).
* The backup (PostCloner, wp_insert_post with kses) is refused when it could not be faithful: for
* users without unfiltered_html, and when the trash is disabled (ruling P9, S37).
*/
@@ -90,6 +91,7 @@ final class GlobalEdits
$usages = $this->usages->of($id);
$details = ['affected' => $usages['items'], 'affected_count' => $usages['count']];
$blocked = $this->blocked($id);
if (($input['confirm'] ?? false) !== true) {
return Errors::confirmRequired(
sprintf(
@@ -97,13 +99,13 @@ final class GlobalEdits
. 'veröffentlichte. Nichts wurde gespeichert (Probelauf).',
$id,
$usages['count'],
$usages['count'] === 1 ? 'Seite' : 'Seiten'
),
$details
self::pages($usages['count'])
) . self::blockedNote($blocked),
$details + self::blockedDetails($blocked)
);
}
$refusal = $this->pagesRefusal($id) ?? $this->backupRefusal($item);
$refusal = $this->pagesRefusal($id, $blocked) ?? $this->backupRefusal($item);
if ($refusal !== null) {
return $refusal;
}
@@ -125,44 +127,105 @@ final class GlobalEdits
return $error;
}
$usages = $this->usages->of((int) $page->post->ID);
$id = (int) $page->post->ID;
$usages = $this->usages->of($id);
$blocked = $this->blocked($id);
$data = $error->get_error_data();
$details = is_array($data) ? array_diff_key($data, ['status' => true, 'hint' => true]) : [];
return Errors::confirmRequired(
Errors::clientMessage($error)
. sprintf(' Globaler Bibliothekseintrag: wirkt auf %d Seiten (siehe affected).', $usages['count']),
array_merge($details, ['affected' => $usages['items'], 'affected_count' => $usages['count']])
. sprintf(
' Globaler Bibliothekseintrag: wirkt auf %d %s (siehe affected).',
$usages['count'],
self::pages($usages['count'])
)
. self::blockedNote($blocked),
array_merge(
$details,
['affected' => $usages['items'], 'affected_count' => $usages['count']],
self::blockedDetails($blocked)
)
);
}
/** Ruling P8: every published page that shows entry $id must be editable by the user. */
private function pagesRefusal(int $id): ?WP_Error
/**
* Ruling P8a: the live posts (published, private, scheduled – they render now or will) that show
* entry $id and that the user may not edit_post. Drafts and pending posts never block.
*
* @return list<int>
*/
private function blocked(int $id): array
{
$blocked = array_values(array_filter(
$this->usages->publishedIds($id),
static fn (int $pageId): bool => ! current_user_can('edit_post', $pageId)
$live = $this->usages->liveIds($id);
if ($live === []) {
return [];
}
_prime_post_caches($live, false, false);
return array_values(array_filter(
$live,
static fn (int $postId): bool => ! current_user_can('edit_post', $postId)
));
}
/**
* Ruling P8a: a confirmed edit needs edit_post on every live post that shows entry $id.
*
* @param list<int> $blocked
*/
private function pagesRefusal(int $id, array $blocked): ?WP_Error
{
if ($blocked === []) {
return null;
}
$listed = implode(', ', array_slice($blocked, 0, self::LISTED_IDS));
$more = count($blocked) - self::LISTED_IDS;
return Errors::forbidden(
sprintf(
'Globaler Bibliothekseintrag %d erscheint auf veröffentlichten Einträgen, die dieses Konto nicht '
. 'bearbeiten darf (IDs %s%s); nichts wurde gespeichert.',
'Globaler Bibliothekseintrag %d erscheint auf veröffentlichten, privaten oder geplanten Einträgen, '
. 'die dieses Konto nicht bearbeiten darf (IDs %s); nichts wurde gespeichert.',
$id,
$listed,
$more > 0 ? sprintf(' und %d weitere', $more) : ''
self::listed($blocked)
),
'Die Änderung von jemandem vornehmen lassen, der alle diese Seiten bearbeiten darf (z. B. Redakteur '
'Die Änderung von jemandem vornehmen lassen, der alle diese Einträge bearbeiten darf (z. B. Redakteur '
. 'oder Administrator).'
);
}
/** @param list<int> $blocked */
private static function blockedNote(array $blocked): string
{
return $blocked === [] ? '' : sprintf(
' Achtung: Die Bestätigung würde abgelehnt – veröffentlichte, private oder geplante Einträge, die dieses '
. 'Konto nicht bearbeiten darf, zeigen den Eintrag (IDs %s, siehe blocked_ids).',
self::listed($blocked)
);
}
/**
* @param list<int> $blocked
* @return array<string, list<int>>
*/
private static function blockedDetails(array $blocked): array
{
return $blocked === [] ? [] : ['blocked_ids' => $blocked];
}
/** @param list<int> $ids At most LISTED_IDS of them, then "und N weitere". */
private static function listed(array $ids): string
{
$more = count($ids) - self::LISTED_IDS;
return implode(', ', array_slice($ids, 0, self::LISTED_IDS))
. ($more > 0 ? sprintf(' und %d weitere', $more) : '');
}
private static function pages(int $count): string
{
return $count === 1 ? 'Seite' : 'Seiten';
}
/** Ruling P9: a backup (only made when revisions are off) must be faithful and must survive. */
private function backupRefusal(WP_Post $item): ?WP_Error
{