wordpress-mobile / wordpress-mobile/WordPress-Android
Able to delete media from Sites without admin rights [Type] Bug
Open
Nobody has claimed this yet.
[Pri] Medium
[Type] Bug
groundskeeping
Media
- Dominant language
- Kotlin
- Stars
- 3.2k
- Forks
- 1.4k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 69
Description
Expected behavior
User should not be able to delete media from Sites with no Admin rights
Actual behavior
Able to delete media without Admin rights
Steps to reproduce the behavior
WP > Media > Select any image. Notice the Trash icon on the top right.
Tested on [device], Android [version], WPAndroid [version]
Samsung S21 Ultra, Android 11, WP 18.2-rc-3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the WP > Media flow on the listed Android and WPAndroid versions, then trace the Trash action for a user without Admin rights. Done means non-admin users cannot delete Site media while users with Admin rights retain the expected deletion behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authorization, mobile
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100