WordPress.org

Make WordPress Core

Opened 2 years ago

Last modified 8 weeks ago

#19834 new feature request

More Robust Capabilities for Attachments — at Version 11

Reported by: walkinonwat3r Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Media Keywords: needs-patch
Focuses: Cc:

Description (last modified by scribu)

Attachments/files should have their own set of capabilities mirroring those of posts, in addition to upload_files. Specifically:

  • read_attachments
  • edit_attachments
  • edit_others_attachments
  • delete_attachments
  • delete_others_attachments

Currently, attachments rely on the edit_posts capability, which can create complications if you don't want your users to see the "Posts" sidebar item, or don't want them to be able to delete the attachments they upload.

Change History (11)

comment:2 in reply to: ↑ description ; follow-up: DrewAPicture2 years ago

  • Cc xoodrew@… added
  • Keywords needs-patch added

Replying to walkinonwat3r:

-edit_attachments
-edit_others_attachments
-delete_attachments
-delete_others_attachments

I agree. Editing posts and editing attachments/media are mutually exclusive. It makes little sense to allow users caps to upload media but not edit it without having to grant them the ability to also edit posts. +1

comment:3 ocean902 years ago

  • Description modified (diff)

comment:4 in reply to: ↑ 2 ; follow-up: azaozz2 years ago

Replying to DrewAPicture:

Editing posts and editing attachments/media are mutually exclusive...

Attachments are posts too and have all capabilities as "normal" posts: post_content, taxonomies, meta, comments, etc. Think of them as built-in CPT. Also they are usually attached to a text (normal) post.

In that terms I'm not sure how editing attachments and posts are "mutually exclusive". A user that shouldn't be editing posts (i.e. not trusted) shouldn't be able to edit attachments either.

comment:5 in reply to: ↑ 4 ; follow-up: DrewAPicture2 years ago

Replying to azaozz:

In that terms I'm not sure how editing attachments and posts are "mutually exclusive". A user that shouldn't be editing posts (i.e. not trusted) shouldn't be able to edit attachments either.

Well, let me give you a simple use case: News websites. Often, you'll have a photo editor or media person adding media to already-existing content. They don't need the ability to edit the written content but they DO need the ability to upload media and edit that media's metadata. And currently, you have to have the edit_posts cap to do that.

What I mean be mutually exclusive is that editing posts is not the same as editing pages is not the same as editing media. They may all be structurally treated as post types but they serve very different purposes.

comment:6 in reply to: ↑ 5 azaozz2 years ago

Replying to DrewAPicture:

...Often, you'll have a photo editor or media person adding media to already-existing content. They don't need the ability to edit the written content but they DO need the ability to upload media and edit that media's metadata. And currently, you have to have the edit_posts cap to do that.

Not sure this can be achieved without some kind of (advanced) plugin. How would a user insert media in a post without being able to edit that post?

What I mean be mutually exclusive is that editing posts is not the same as editing pages is not the same as editing media. They may all be structurally treated as post types but they serve very different purposes.

Right. We are looking at that from different angles: from user trust/security point of view all of these require a "trusted user". Further granularity of permissions for different post types seems best handled by a plugin (as it is currently).

comment:7 DrewAPicture2 years ago

Replying to azaozz:

Replying to DrewAPicture:

...Often, you'll have a photo editor or media person adding media to already-existing content. They don't need the ability to edit the written content but they DO need the ability to upload media and edit that media's metadata. And currently, you have to have the edit_posts cap to do that.

Not sure this can be achieved without some kind of (advanced) plugin. How would a user insert media in a post without being able to edit that post?

In the case I outlined, content editors pull uploaded content from the Media Library, so the photo people upload the media with all associated EXIF data and that's all they have to do. But once they hit upload, they can't edit any of the associated metadata for that media without giving them edit_posts. That's the problem.

Right. We are looking at that from different angles: from user trust/security point of view all of these require a "trusted user". Further granularity of permissions for different post types seems best handled by a plugin (as it is currently).

This isn't about "further granularity", it's about "should already be there but isn't granularity". Users with the upload_files cap can upload files but not edit them without the edit_posts cap. If you're uploading to the Media Library outside of post edit, Post and Page permissions should have no bearing on whether you have the ability to edit the media you just uploaded (see: @walkinonwat3r's comment:ticket:19817:2). It would be akin to allowing users to submit posts for review but not allowing them to edit their posts after they click submit.

Last edited 2 years ago by DrewAPicture (previous) (diff)

comment:8 follow-up: mtwelve2 years ago

Another example is when using Media items with Custom Post Types

I have a CPT that requires files to be attached to it. The person in charge of this CPT doesn't need any access to Posts but even if I hide the menu items they will still be able to access those sections. Ideally I could give them the capability to just manage attachments.

Anything we can do to promote this problem!?

comment:9 in reply to: ↑ 8 scribu23 months ago

Replying to mtwelve:

I have a CPT that requires files to be attached to it. The person in charge of this CPT doesn't need any access to Posts but even if I hide the menu items they will still be able to access those sections.

You can assign different capabilities for that CPT by using the 'capabilities' option from register_post_type().

In general, the capabilities for editing a CPT are already separate from those required to edit attachments, so this ticket doesn't really help you.

comment:10 scribu23 months ago

In #20802 it was noted that there should also be a 'read_attachments' capability, just like we have a 'read' cap for posts.

comment:11 scribu23 months ago

  • Description modified (diff)
Note: See TracTickets for help on using tickets.