Opened 2 years ago

Last modified 2 years ago

#16808 new defect (bug)

Insufficient permissions for custom post type management and custom role/caps

Reported by: Genesis2001 Owned by:
Priority: normal Milestone: Awaiting Review
Component: Role/Capability Version: 3.1
Severity: normal Keywords:
Cc: zack@…

Description (last modified by nacin)

I asked a question over at StackExchange about this. Went into their chat room to talk to a few people and came to the conclusion I need to post this ticket.

---

When accessing an admin page located at post-new.php with a custom post type on a user that's in a custom role that has the available permission to "Add New", you get "You do not have sufficient permissions to access this page."

		$post_caps = array( 'delete_post' => 'argus_admin', );
		$visitor_caps = $post_caps;
		$visitor_caps = array_merge( $visitor_caps, array(
				'edit_post' => 'argus_visitors',
				'read_post' => 'argus_visitors',
				'edit_posts' => 'argus_visitors',
				'edit_others_posts' => 'argus_visitors',
				'publish_posts' => 'argus_visitors',
				'read_private_posts' => 'argus_visitors',
			));

		$v_args = array(
			'labels' => array (
					'name' => 'Visitors',
					'singular_name' => 'Visitor',
					'add_new_item' => 'Register New Visitor',
				),
			'public' => true,
			'publicly_queryable' => false,
			'exclude_from_search' => true,
			'show_ui' => true,
			'show_in_menu' => 'argus',
			//'show_in_menu' => false,
			'hiearchical' => false,
			'supports' => array( '' ),
			'capabilities' => $visitor_caps,
			'register_meta_box_cb' => array ( &$this, '_wp_visitor_meta_box_cb' ),
		);
		
		register_post_type( 'visitor', $v_args );

I've tested it with 3.0.4 and it worked flawlessly. However, when in 3.1, it doesn't want to work.

Change History (6)

Related: #16714

  • Description modified (diff)

comment:3 follow-up: ↓ 4   nacin2 years ago

What capabilities does a visitor have? Simply argus_visitors and no other capabilities?

comment:4 in reply to: ↑ 3   Genesis20012 years ago

  • Cc zack@… added

Replying to nacin:

What capabilities does a visitor have? Simply argus_visitors and no other capabilities?

Hmm? The Visitor CPT has all caps set to a single permission (K.I.S.S.) "argus_visitors". If that's what you mean, yes.

Seems like it might have to do with show_in_menu. What is 'argus'? Keep in mind show_in_menu is new in 3.1 so that might be your change.

'argus' is a custom menu I have which I use to group my CPT's together instead of all-over my Admin CP.

		add_menu_page( 'Argus', 'Argus Admin', 'argus', 'argus', array( &$this, '_wp_argus_main_panel' ), '', -1 );
		add_submenu_page( 'argus', 'Argus Administration', 'Control Panel', 'argus', 'argus', array( &$this, '_wp_argus_main_panel' ) );

I use the same slug for both menus there because of the duplicate menu item that gets generated. I did however test it by changing the submenu to 'arguscp' and that created a second sub-menu (undesired if add_menu_page also creates an identical sub-menu underneath itself). Same behaviour occurred when I did so ("Insufficient Permissions" error)

Note: See TracTickets for help on using tickets.