WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 3 years ago

#14420 closed defect (bug) (fixed)

Author drop-down not displayed for post inline edit form

Reported by: garyc40 Owned by:
Milestone: 3.1 Priority: normal
Severity: major Version: 3.0
Component: Role/Capability Keywords: has-patch
Focuses: Cc:

Description

This is a bug.

Suppose, for a particular wordpress installation, there are one admin and one editor. The editor can post or edit contents. As a result, they both appear on the Author list if we try to "Quick Edit" posts in Posts->Edit.

Now, if the editor is demoted to "subscriber" role, for example, he loses all capabilities to post or edit contents. If we try to "Quick Edit" his posts in Posts->Edit, there is no Author list. This is because the drop-down list is automatically hidden if there's only one editable user ID.

wp-admin/includes/template.php - line 931 - 942

$authors = get_editable_user_ids( $current_user->id, true, $screen->post_type ); // TODO: ROLE SYSTEM
$authors_dropdown = '';
if ( $authors && count( $authors ) > 1 ) :
	$users_opt = array('include' => $authors, 'name' => 'post_author', 'class'=> 'authors', 'multi' => 1, 'echo' => 0);
	if ( $bulk )
		$users_opt['show_option_none'] = __('— No Change —');
	$authors_dropdown  = '<label>';
	$authors_dropdown .= '<span class="title">' . __( 'Author' ) . '</span>';
	$authors_dropdown .= wp_dropdown_users( $users_opt );
	$authors_dropdown .= '</label>';

endif; // authors

As a result, if we attempt to save the post by using the "Quick Edit" form, the post's author is automatically set to the person who's editing the post (i.e. admin in our scenario).

I believe this is a bug, because inline-edit-post.dev.js clearly handles the case where a user lost edit capabilities:

wp-admin/js/inline-edit-post.dev.js - line 128 - 131

if ( !$(':input[name="post_author"] option[value=' + $('.post_author', rowData).text() + ']', editRow).val() ) {
	// author no longer has edit caps, so we need to add them to the list of authors
	$(':input[name="post_author"]', editRow).prepend('<option value="' + $('.post_author', rowData).text() + '">' + $('#' + t.type + '-' + id + ' .author').text() + '</option>');
}

However, when the author list is hidden because there's only one user on the list, clearly the true author is not added properly.

Attached is the patch.

Attachments (1)

author-dropdown.patch (832 bytes) - added by garyc40 4 years ago.

Download all attachments as: .zip

Change History (4)

garyc404 years ago

comment:1 markjaquith3 years ago

  • Milestone changed from Awaiting Review to 3.1

comment:2 markjaquith3 years ago

I'm going to display the HTML and then do the hiding in JS if there is only one option.

comment:3 markjaquith3 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [17284]) Show the author dropdown in quick edit even when there is only one contributor-or-higher user and the post belongs to someone who no longer has contributor-or-higher access. fixes #14420

Note: See TracTickets for help on using tickets.