Merge 7aee799 into 856d135

xwp · Aug 17, 2016 · d15b2e1 · d15b2e1
2 parents 856d135 + 7aee799
commit d15b2e1
Show file tree

Hide file tree

Showing 3 changed files with 41 additions and 25 deletions.
diff --git a/js/customize-snapshots.js b/js/customize-snapshots.js
@@ -56,7 +56,9 @@
 
 			component.extendPreviewerQuery();
 			component.addButtons();
-			component.addSchedule();
+			if ( component.data.currentUserCanPublish ) {
+				component.addSchedule();
+			}
 
 			$( '#snapshot-save' ).on( 'click', function( event ) {
 				var scheduleDate;
@@ -209,34 +211,36 @@
 		snapshotButton.insertAfter( publishButton );
 
 		// Schedule button.
-		scheduleButton = wp.template( 'snapshot-schedule-button' );
-		scheduleButton = $( $.trim( scheduleButton( {} ) ) );
-		scheduleButton.insertAfter( snapshotButton );
+		if ( component.data.currentUserCanPublish ) {
+			scheduleButton = wp.template( 'snapshot-schedule-button' );
+			scheduleButton = $( $.trim( scheduleButton( {} ) ) );
+			scheduleButton.insertAfter( snapshotButton );
 
-		if ( ! component.data.editLink ) {
-			scheduleButton.hide();
-		}
+			if ( ! component.data.editLink ) {
+				scheduleButton.hide();
+			}
 
-		api.state( 'change', function() {
-			scheduleButton.toggle( api.state( 'snapshot-saved' ).get() && api.state( 'snapshot-exists' ).get() );
-		} );
+			api.state( 'change', function() {
+				scheduleButton.toggle( api.state( 'snapshot-saved' ).get() && api.state( 'snapshot-exists' ).get() );
+			} );
 
-		api.state( 'snapshot-exists' ).bind( function( exist ) {
-			scheduleButton.toggle( exist );
-		} );
+			api.state( 'snapshot-exists' ).bind( function( exist ) {
+				scheduleButton.toggle( exist );
+			} );
 
-		api.state( 'snapshot-saved' ).bind( function( saved ) {
-			snapshotButton.prop( 'disabled', saved );
-		} );
+			api.state( 'snapshot-saved' ).bind( function( saved ) {
+				snapshotButton.prop( 'disabled', saved );
+			} );
 
-		api.state( 'saved' ).bind( function( saved ) {
-			if ( saved ) {
-				snapshotButton.prop( 'disabled', true );
-			}
-		} );
-		api.bind( 'change', function() {
-			snapshotButton.prop( 'disabled', false );
-		} );
+			api.state( 'saved' ).bind( function( saved ) {
+				if ( saved ) {
+					snapshotButton.prop( 'disabled', true );
+				}
+			} );
+			api.bind( 'change', function() {
+				snapshotButton.prop( 'disabled', false );
+			} );
+		}
 
 		api.state( 'snapshot-exists' ).bind( function( exists ) {
 			var buttonText, permsMsg;
@@ -303,6 +307,10 @@
 
 		component.scheduleContainerDisplayed = new api.Value();
 
+		if ( ! component.data.currentUserCanPublish ) {
+			return;
+		}
+
 		// Inject the UI.
 		if ( _.isEmpty( component.schedule.container ) ) {
 			if ( '0000-00-00 00:00:00' === component.data.publishDate ) {
@@ -425,7 +433,7 @@
 			sliceBegin = 0,
 			sliceEnd = -2;
 
-		if ( _.isEmpty( component.schedule.container ) ) {
+		if ( _.isEmpty( component.schedule.container ) || ! component.data.currentUserCanPublish ) {
 			return;
 		}
 

diff --git a/php/class-customize-snapshot-manager.php b/php/class-customize-snapshot-manager.php
@@ -1079,6 +1079,10 @@ public function handle_update_snapshot_request() {
 			status_header( 400 );
 			wp_send_json_error( 'bad_status' );
 		}
+		if ( 'future' === $status && ! current_user_can( 'customize_publish' ) ) {
+			status_header( 400 );
+			wp_send_json_error( 'customize_not_allowed' );
+		}
 		$publish_date = isset( $_POST['publish_date'] ) ? $_POST['publish_date'] : '';
 		if ( 'future' === $status ) {
 			$publish_date_obj = new \DateTime( $publish_date );

diff --git a/php/class-post-type.php b/php/class-post-type.php
@@ -585,6 +585,10 @@ public function filter_user_has_cap( $allcaps, $caps ) {
 				$allcaps[ $granted_cap ] = current_user_can( 'customize' );
 			}
 
+			if ( ! current_user_can( 'customize_publish' ) || empty( $allcaps['customize_publish'] ) ) {
+				$allcaps[ $post_type_obj->cap->publish_posts ] = false;
+			}
+
 			if ( ! current_user_can( 'edit_others_posts' ) ) {
 				$allcaps[ $post_type_obj->cap->edit_others_posts ] = false;
 			}