Wrong capability check (edit_posts)

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support Adrian

    (@adrianrus)

    3 weeks, 2 days ago

    Hi @julienlusson ,

    Thank you for your message and for using our plugin! 🙂

    In this case it isn’t a bug: edit_post and edit_posts are two different capabilities in WordPress, and the plugin is using the right one for this check.

    • edit_posts is a primitive capability, used without arguments, current_user_can('edit_posts') meaning “can this user edit posts in general?”
    • edit_post is a meta capability. It takes an object ID, current_user_can('edit_post', $post_id) meaning “can this user edit this particular post?” WordPress resolves it at runtime through map_meta_cap() into the appropriate primitive capabilities (edit_posts, edit_others_posts, edit_published_posts, etc.) based on that post’s author and status.

    Enable Media Replace calls it as current_user_can('edit_post', $post_id) with the attachment ID, so it’s the meta capability and the usage is correct.

    The Roles and Capabilities page you linked documents the capabilities assigned to roles; it doesn’t cover meta capabilities like edit_post. Those are documented with map_meta_cap(): https://developer.wordpress.org/reference/functions/map_meta_cap/

    Changing it to edit_posts would actually weaken the check. It would only confirm the user can edit posts somewhere, dropping the per-attachment ownership check, so a Contributor could pass it for another user’s media. The singular form with the ID is the stricter behaviour, which is what we want here.

    I hope it makes more sense now!

    All the best,

    Thread Starter julienlusson

    (@julienlusson)

    3 weeks, 1 day ago

    Hi @adrianrus,

    Thanks for your answer.

    My bad, I was testing with an account without the “edit_other_posts” capability and no media in the library from this user, so it was working as intended and it’s not a bug.

    I don’t want the user to make “Posts” elements but use only “Pages” to create WordPress webpages. But the catch is that WordPress capabilities are quite limited for that: *_posts capabilities are both for “Posts” and “Media”, so we can’t only block post or media with “capabilities”.

    Now, I’ve blocked the access to “post” creation with other means and added the “edit_other_posts” cap to the user and now your plugin work well.

    With another plugin, the media replacement of other media files was working without the
    “edit_other_posts” capability, but now, I see that’s quite a flaw of the other plugin.

    Regards

    Plugin Support Adrian

    (@adrianrus)

    3 weeks, 1 day ago

    Hi @julienlusson ,

    No worries at all and thanks for coming back to confirm! Glad it turned out to be working as intended! 🙂

    As for the other plugin, yes, a per-object ownership check is generally the safer way.

    All the best,

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.