WordPress.org

Ready to get started?Download WordPress

Forums

Co-Authors Plus
[resolved] Authors *can* set co-authors, despite documentation saying otherwise (4 posts)

  1. smerriman
    Member
    Posted 2 years ago #

    I'm setting up a site where I don't want people with just author-level permission to be able to set co-authors. The plugin documentation says that this is the case, and only editor or higher can. However, that's not true. An author role is able to change authors on their own posts.

    This is because:

    a) The check in your plugin is done by current_user_can_set_authors which checks if the edit_others_posts capability is set

    b) This hooks into the user_can_cap filter which calls add_coauthor_cap

    c) This determines I am the author of the post, so adds the edit_others_posts capability, therefore making the whole thing return true.

    I believe I can get around this anyway by hooking into the coauthors_plus_edit_authors filter, which is probably a good idea anyway, but there's messages and todos around the place saying you want to integrate this into a future version - it's already there? What am I missing?

    http://wordpress.org/extend/plugins/co-authors-plus/

  2. Daniel Bachhuber
    Hand Built
    Plugin Author

    Posted 2 years ago #

    Filtering is your best bet for now. I'd like to rewrite the caps code for v2.6.2 so it's a bit more accessible, works better, easier to understand, etc. but there's no ETA for that yet.

    You might want to check out this code snippet for an example.

  3. smerriman
    Member
    Posted 2 years ago #

    OK - the filter works for that part, but the javascript file still gets enqueued, which breaks all javascript on the page when the co-authors plus meta box doesn't exists. Hacking in && $this->current_user_can_set_authors() in the enqueue_scripts function seems to work - hopefully that can be there in a future version (I see there's a comment in that function that it should be inserted, so hopefully there wasn't any specific reason you didn't :))

  4. Daniel Bachhuber
    Hand Built
    Plugin Author

    Posted 2 years ago #

    Thanks for the catch. This commit is part of the way there.

Topic Closed

This topic has been closed to new replies.

About this Plugin

About this Topic