Ticket #44176: 44176.diff

src/wp-admin/erase-personal-data.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once( dirname( __FILE__ ) . '/admin.php' );
 
-if ( ! current_user_can( 'erase_others_personal_data' ) || ! current_user_can( 'delete_users' ) ) {
+if ( ! current_user_can( 'erase_others_personal_data' ) ) {
         wp_die( __( 'Sorry, you are not allowed to erase data on this site.' ) );
 }
 

src/wp-admin/includes/ajax-actions.php

@@ -4890 +4890 @@
                 wp_send_json_error( __( 'Invalid request ID.' ) );
         }
 
-        // Both capabilities are required to avoid confusion, see `_wp_personal_data_removal_page()`.
-        if ( ! current_user_can( 'erase_others_personal_data' ) || ! current_user_can( 'delete_users' ) ) {
+        if ( ! current_user_can( 'erase_others_personal_data' ) ) {
                 wp_send_json_error( __( 'Sorry, you are not allowed to perform this action.' ) );
         }
 

src/wp-admin/includes/schema.php

@@ -695 +695 @@
         populate_roles_270();
         populate_roles_280();
         populate_roles_300();
+        populate_roles_540();
 }
 
 /**
@@ -924 +925 @@
         }
 }
 
+/**
+ * Create and modify WordPress roles for WordPress 5.4.
+ *
+ * @since 5.4.0
+ */
+function populate_roles_540() {
+        // Add the caps to the Administrators as they were split.
+        $role = get_role( 'administrator' );
+
+        if ( ! empty( $role ) ) {
+                $role->add_cap( 'export_others_personal_data' );
+                $role->add_cap( 'erase_others_personal_data' );
+                $role->add_cap( 'manage_privacy_options' );
+        }
+
+        // Introduce DPO and add all the caps by default.
+        add_role( 'dpo', 'DPO' );
+
+        $role = get_role( 'dpo' );
+
+        if ( ! empty( $role ) ) {
+                $role->add_cap( 'export_others_personal_data' );
+                $role->add_cap( 'erase_others_personal_data' );
+                $role->add_cap( 'manage_privacy_options' );
+                $role->add_cap( 'read' );
+                $role->add_cap( 'level_0' );
+                $role->add_cap( 'edit_pages' );
+                $role->add_cap( 'edit_others_pages' );
+                $role->add_cap( 'edit_published_pages' );
+                $role->add_cap( 'publish_pages' );
+                $role->add_cap( 'delete_pages' );
+                $role->add_cap( 'delete_others_pages' );
+                $role->add_cap( 'delete_published_pages' );
+                $role->add_cap( 'delete_private_pages' );
+                $role->add_cap( 'edit_private_pages' );
+                $role->add_cap( 'read_private_pages' );
+        }
+}
+
 if ( ! function_exists( 'install_network' ) ) :
         /**
          * Install Network.

src/wp-admin/menu.php

@@ -288 +288 @@
         $submenu['tools.php'][50] = array( __( 'Network Setup' ), 'setup_network', 'network.php' );
 }
 
-$menu[80]                               = array( __( 'Settings' ), 'manage_options', 'options-general.php', '', 'menu-top menu-icon-settings', 'menu-settings', 'dashicons-admin-settings' );
+if ( current_user_can( 'manage_options' ) ) {
+        $menu[80] = array( __( 'Settings' ), 'manage_options', 'options-general.php', '', 'menu-top menu-icon-settings', 'menu-settings', 'dashicons-admin-settings' );
+} elseif ( current_user_can( 'manage_privacy_options' ) && ! current_user_can( 'manage_options' ) ) {
+        $menu[80] = array( __( 'Settings' ), 'manage_privacy_options', 'options-general.php', '', 'menu-top menu-icon-settings', 'menu-settings', 'dashicons-admin-settings' );
+}
+
         $submenu['options-general.php'][10] = array( _x( 'General', 'settings screen' ), 'manage_options', 'options-general.php' );
         $submenu['options-general.php'][15] = array( __( 'Writing' ), 'manage_options', 'options-writing.php' );
         $submenu['options-general.php'][20] = array( __( 'Reading' ), 'manage_options', 'options-reading.php' );

src/wp-includes/capabilities.php

@@ -574 +574 @@
                         }
                         break;
                 case 'export_others_personal_data':
+                        $caps[] = 'export_others_personal_data';
+                        break;
                 case 'erase_others_personal_data':
+                        $caps[] = 'erase_others_personal_data';
+                        break;
                 case 'manage_privacy_options':
-                        $caps[] = is_multisite() ? 'manage_network' : 'manage_options';
+                        $caps[] = 'manage_privacy_options';
                         break;
                 default:
                         // Handle meta capabilities for custom post types.