Automattic / Automattic/co-authors-plus
current_user_can( 'edit_others_posts' ) returns true for author and contributors while called in some contexts.
- Dominant language
- PHP
- Stars
- 322
- Forks
- 218
- Avg merge
- 7h 50m
- Merged PRs (30d)
- 65
Description
When calling current_user_can( 'edit_others_posts' ) in filters or actions like 'add_meta_boxes' the function will return true for current users that are authors or contributors. It is expected to return false.
Example of the problem:
``` php
add_action( 'add_meta_boxes', 'add_editor_only_meta_box' );
function add_editor_only_meta_box(){
if( current_user_can( 'edit_others_posts' ) )
add_meta_box( … );
}
```
In this example, we should not expect Authors and Contributors to see the meta box but they actually will.
In the context of add_meta_boxes ( and other filter/actions ), current_user_can( 'edit_others_posts' ) will return true even if the current user is of the author or contributor role. Outside of certain filter/action hooks current_user_can( 'edit_others_posts' ) will output as expected.
CAP modifies capacities of the user temporarily so that they can modify any posts for which they are a co-author. It does this by filtering on user_has_cap with the method filter_user_has_cap() of the CAP class.
The resolution to this may lie in rewriting permissions with map meta cap
https://github.com/Automattic/Co-Authors-Plus/issues/103
as is hinted in this exchange between Daniel and Nacin:
http://core.trac.wordpress.org/ticket/22415
Contributor guide
Research direction
Start with the CAP class's filter_user_has_cap() method and reproduce the current_user_can( 'edit_others_posts' ) check from the add_meta_boxes example. Review the linked map_meta_cap discussion and related WordPress references before choosing an approach. Done means authors and contributors receive false in these contexts while CAP's co-author behavior remains correct.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100