Bug report: media permission issue

Unauthorized users can still see blocked medias

Test environment: A freshly installed wordpress environment with no other plugins installed.

Steps to replicate:
[1] In PP Permission settings, make sure nobody can see other people’s medias:

1.1 Check Core, Filter Types, Media.

1.2 Uncheck Media Library, Other users’ unattached uploads listed by default

1.3 Uncheck Media Library, List other users’ uploads if attached to a readable post

1.4 Uncheck Media Library, List other users’ uploads if attached to an editable post

1.5 Uncheck Media Library, Allow editing other users’ uploads if attached to an editable post

1.6 Check Prevent editing uploads if attached to a non-editable post

[2] Create an user with author role

[3] Upload any media as admin. The execution order of step 2 and 3 are interchangeable.

[4] Optionally check to ensure that the author user doesnt see the media uploaded by admin

[5] As the author user, create a post. Add a link to the post. Type the name of the media uploaded by the admin. Within a few keys strokes, the media is hinted, the author can add this media to the post and use the link to see the media.

Ideally, blocked media shouldnt show up in hints and accessing links to blocked medias should return 404.

• This topic was modified 7 months ago by antonhg.