Automattic / Automattic/co-authors-plus

current_user_can( 'edit_others_posts' ) returns true for author and contributors while called in some contexts.

Open
#138 3 comments 0 reactions 0 assignees View on GitHub
type: bug
Dominant language
PHP
Stars
322
Forks
218
Avg merge
7h 50m
Merged PRs (30d)
65

Description

When calling current_user_can( 'edit_others_posts' ) in filters or actions like 'add_meta_boxes' the function will return true for current users that are authors or contributors. It is expected to return false.

Example of the problem:

``` php
add_action( 'add_meta_boxes', 'add_editor_only_meta_box' );
function add_editor_only_meta_box(){
if( current_user_can( 'edit_others_posts' ) )
add_meta_box( … );
}
```

In this example, we should not expect Authors and Contributors to see the meta box but they actually will.

In the context of add_meta_boxes ( and other filter/actions ), current_user_can( 'edit_others_posts' ) will return true even if the current user is of the author or contributor role. Outside of certain filter/action hooks current_user_can( 'edit_others_posts' ) will output as expected.

CAP modifies capacities of the user temporarily so that they can modify any posts for which they are a co-author. It does this by filtering on user_has_cap with the method filter_user_has_cap() of the CAP class.

The resolution to this may lie in rewriting permissions with map meta cap
https://github.com/Automattic/Co-Authors-Plus/issues/103
as is hinted in this exchange between Daniel and Nacin:
http://core.trac.wordpress.org/ticket/22415

Contributor guide

Open the contributing guide

Research direction

Start with the CAP class's filter_user_has_cap() method and reproduce the current_user_can( 'edit_others_posts' ) check from the add_meta_boxes example. Review the linked map_meta_cap discussion and related WordPress references before choosing an approach. Done means authors and contributors receive false in these contexts while CAP's co-author behavior remains correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.