Post gets published even though user can't publish_posts

[SimonK]

When users don't have the "publish_posts" capability, but DO have the "edit_published_posts" capability, they can publish posts directly. This happens when they press "Submit for Review" AFTER the post has been saved (either manually or autosave). I've located the bug in /wp-admin/includes/post.php, and fixed it (temporarily) by adding the following code after line 71.

// START fix
if ('publish' == $_POST['post_status'] && !current_user_can( 'publish_posts' )) {
	$_POST['post_status'] = 'pending';
}
// END fix

This is the piece of code that causes the bug (I think..):

	} else {
		if ('publish' == $_POST['post_status'] && !current_user_can( 'edit_published_posts' ))
			$_POST['post_status'] = 'pending';
	}

(line 68-71 in /wp-admin/includes/post.php)

Note: this bug only occures when using a plugin to change roles/capabilities, but that doesn't make it a bug in the plugin I think.

Since this works correctly without the plugin and the plugin creates the problem, doesn't that mean that the plugin has the bug and not WP? You could probably pick quite a few things in the WP code and create a plugin to do something that it isn't supposed to do. That doesn't make it a bug in WP.

Bringing this up again:

No, this is not a bug in the plugin, the plugin in question is simply the Role Manager. This is a definite WordPress bug.

To reproduce:

1. Make a user who can edit_published_posts but not publish_posts himself. As these are separate capabilities, it's possible to create a user this way.
2. Create a new post.
3. Save it as draft.
4. Submit it for review.

Result: it publishes instead of going to pending.
Desired result: As the user does not have publish_posts, it should not publish.

Fix:
Change this:
`if ('publish' == $_POSTpost_status? && !current_user_can( 'edit_published_posts' ))
$_POSTpost_status? = 'pending';`

to this:
`if ('publish' == $_POSTpost_status? && !current_user_can( 'edit_published_posts' ) && !current_user_can( 'publish_posts' ))
$_POSTpost_status? = 'pending';`

Same with pages just above that.

Is this still valid?

I copied the Editors role (Which includes edit_published_*), removed the publish_* caps, and submitted a post for review. The post came up as Pending.

Seems to me that it was fixed in the 2.7 UI overhaul? Re-open if problem persists.