Use a safer capability default when post_author == 0

[danielbachhuber]

There are a few cases in which posts can get created without an assigned author:

• WP-CLI needs a --user argument in order to set the user context for performing any action. It's easy to forget to do this.
• WP-Cron performing, say, a syndication import can create posts without assigned authors if no author is explicitly identified when using wp_insert_post().
• Co-Authors Plus supports creating posts without assigning a byline, as well as assigning a "guest author", which doesn't exist as a user entity and so no post_author assignment is made.

Although core doesn't explicitly support it via UI, there are valid ways in which posts can get created without an assigned author.

With that being said, a post without an assigned author currently can be edited by any user with edit_posts (ref). This means that contributors, often untrusted users within media companies, get more editing capabilities than expected.

I propose that changing the capability check to edit_others_posts when an author isn't assigned would be much safer. A concern is that this change will break some obscure use-case that's been possible for four years.

Genesis commit was r12053, although it looks like that problem should've been fixed higher up the stack.

Related #26659

[nacin]

Yeah, I've never been sure why we've defaulted to the current user when post_author = 0. I agree it should be edit_others_posts by default. I am wondering if we can change this without causing problems, but given the concerns of privilege escalation, I'm also not as worried about the side effects. Let's try it out.

[westi]

Replying to nacin:

Yeah, I've never been sure why we've defaulted to the current user when post_author = 0. I agree it should be edit_others_posts by default. I am wondering if we can change this without causing problems, but given the concerns of privilege escalation, I'm also not as worried about the side effects. Let's try it out.

It seems reasonable to try it out.

I'm not convinced that posts with an author of 0 work well in other ways too - I have a feeling there are comment moderation issues, if we are going to make them work better we should check all the different ways capability checks interact with post objects and create test cases for how we expect them to work.

[danielbachhuber]

Change default edit, view, and trash capabilities for authorless posts to require editor equivalent or above

[danielbachhuber]

Tests for the patch

[danielbachhuber]

Added patch and tests for edit_post, read_post, and delete_post.

Per westi's comment, *_post_metafalls back to map_meta_cap( 'edit_post' ), as does edit_comment. For the former, I don't foresee any problems with this change.

For the latter, an author can view comments on Manage Comments, but not edit unless they have edit permissions on the post. Editors can view and edit. Contributors can only view.

This behavior seems expected to me, but open to feedback and direction.

[danielbachhuber]

27020.2.diff is a combined patch that also includes tests directly against map_meta_cap()

[nacin]

In 27390:

Don't default to current user for capability checks when dealing with a post without an author (post_author = 0).

Undoes [12053]. While it risks breakage, this is a far safer and saner default for these situations.

props danielbachhuber.
fixes #27020.