{"id":8618094,"date":"2017-01-04T15:13:46","date_gmt":"2017-01-04T15:13:46","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/permissionscapability-issue\/"},"modified":"2017-01-04T15:14:27","modified_gmt":"2017-01-04T15:14:27","slug":"permissionscapability-issue","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/permissionscapability-issue\/","title":{"rendered":"Permissions\/capability issue"},"content":{"rendered":"<p>Very nice plugin @jamiechong, it&#8217;s simple but works.<\/p>\n<p>However I&#8217;ve spotted a permissions issue.<\/p>\n<p>If a user has the &#8216;publish_posts&#8217; capability, this means they can only publish their own posts, not other users&#8217;. However using this plugin they can Revisionize someone else&#8217;s post, and then Publish that, which then overwrites the other person&#8217;s original post.<\/p>\n<p>I guess there needs to be a check to see if the original post&#8217;s author matches the logged-in user, and only allow a Revisionize draft to be Published then.<\/p>\n<p>What do you think?<\/p>\n","protected":false},"template":"","class_list":["post-8618094","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8618094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8618094\/revisions"}],"predecessor-version":[{"id":8618097,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/8618094\/revisions\/8618097"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=8618094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}