WordPress.org

Make WordPress Core

Opened 7 years ago

Last modified 14 months ago

#23391 new enhancement

User in contributor role can add images to post only via the text editor

Reported by: mark-k Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Role/Capability Keywords: needs-patch
Focuses: ui, administration Cc:
PR Number:

Description

  1. Create a user with contributor role
  2. start new post with it
  3. notice there is no "add media" button anywhere
  4. switch to text editing
  5. use the img button to insert a URL to a valid img on the web
  6. request approval for the post
  7. let admin/editor approve it
  8. go the the post's URL and notice that the image is shown

So, it is not that contributors are not allowed to use images, it is just that WP makes it hard to do so.

Either HTML needs to be sanitized and have all img tags removes for contributors, or access to the media library should be allowed for contributors denying only access to uploading. I vote for the second option.

Change History (5)

#1 follow-up: @ocean90
7 years ago

The "Add media" isn't displayed because the user hasn't the upload_files cap.

Related: #19834

#2 in reply to: ↑ 1 @mark-k
7 years ago

Replying to ocean90:

The "Add media" isn't displayed because the user hasn't the upload_files cap.

I get the code, I just think it is applied in the wrong place. You should not show the upload tab, and maybe not the media tab, but the "from url" and "gallery" tabs don't do anything that a contributor can't do via the text editor.

#3 @chriscct7
5 years ago

  • Focuses ui administration added
  • Keywords needs-patch added

Without the upload_files cap you can still see media files previously uploaded so showing that shouldn't be an issue either

#4 @danielbachhuber
15 months ago

This came up again in the context of Gutenberg:

this logic applies to Contributors and un-customized sites, but what about a situation where a developer would want to lock down the permissions for users to upload but not to select from existing media? I can see many cases where administrators would not want new uploads but would want existing media to be selectable. I, myself, have this very need and this change would wipe out all usability of the media library within G'berg media blocks.

I suggested:

  1. Introduce a new capability around viewing the media library (independent of upload_files but defaulting to upload_files).
  2. Audit core for references to upload_files that could be switched to the new capability.
  3. Update Gutenberg once the implementation is agreed upon for core.

r41290 is existing prior art for plugins. I see the core audit as the bulk of the work for this ticket; not sure how simple it would be to introduce two states of the Media Library (view-only vs. view and upload).

Note: See TracTickets for help on using tickets.