WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 3 years ago

Last modified 3 years ago

#28327 closed defect (bug) (fixed)

Contributor users receive an upload error when attempting to set a Featured Image

Reported by: rickybanister Owned by: wonderboymusic
Milestone: 4.0 Priority: normal
Severity: normal Version: 2.9
Component: Media Keywords: has-patch commit
Focuses: ui, administration Cc:

Description

Contributors are not permitted to upload media, however they are still displayed the 'featured image' widget on post-new.php.

https://i.cloudup.com/GSPxWgvJbY-3000x3000.png

Furthermore, if they attempt to upload media in the media overlay their upload fails and displays an upload error

https://i.cloudup.com/wm5S05B2C_-3000x3000.png

The featured image widget should be hidden from contributors. If the widget is removed, the upload error becomes irrelevant.

Attachments (2)

28327.diff (697 bytes) - added by MikeHansenMe 3 years ago.
check if user can upload files
28327.2.diff (898 bytes) - added by SergeyBiryukov 3 years ago.

Download all attachments as: .zip

Change History (16)

#1 @rickybanister
4 years ago

Additionally, media items that were previously uploaded by admin users do not load for contributors.

Contributors see the spinner, but no media ever loads.

https://i.cloudup.com/sWwrMakbp8-3000x3000.png

#2 @SergeyBiryukov
4 years ago

  • Component changed from General to Media

Related: #19817, #19834.

#3 follow-up: @ericlewis
3 years ago

  • Focuses ui administration added
  • Keywords 2nd-opinion ux-feedback added

Wow. So if you're a contributor, you can't create a post with any media in it. That's a serious editorial workflow issue.

I think we should add 'upload_files' to the contributor role. Thoughts?

#4 in reply to: ↑ 3 ; follow-up: @kpdesign
3 years ago

Replying to ericlewis:

Wow. So if you're a contributor, you can't create a post with any media in it. That's a serious editorial workflow issue.

I think we should add 'upload_files' to the contributor role. Thoughts?

I don't think we should add the upload_files cap to the Contributor role.

A Contributor can delete and edit their own posts, and read. They don't have the capability to publish their own post - any post they create has to be submitted for review.

The Contributor role only has a minimum level of trust. If a contributor is trusted enough to allow them to upload files, then their role should be changed to Author by the site admin.

The post editor doesn't show the Add Media button to contributors, so the Featured Image meta box should be hidden from that role as well.

#5 in reply to: ↑ 4 @ericlewis
3 years ago

  • Keywords 2nd-opinion ux-feedback removed

Replying to kpdesign:

I don't think we should add the upload_files cap to the Contributor role.

I tend to agree with you after reading the discussion on #19834 (More Robust Capabilities for Attachments). I think this ticket is more or less a duplicate of that. However, as this cites a specific bug that needs to be fixed, let's leave this open and follow-up on the user capabilities discussion in that ticket.

@MikeHansenMe
3 years ago

check if user can upload files

#6 @ryan
3 years ago

Upload error messages in the modal are not at all helpful. Another instance is failed video uploads. Even a tiny 3 second video upload will fail on most hosts. Our error messages are useless dead ends. We need to see these messages in the context of flows like this and make them relevant and useful.

#7 @ryan
3 years ago

This prompted me to do a visual record as a contributor.

http://make.wordpress.org/flow/2014/07/10/setting-featured-image-as-a-contributor-macnchrome-4-0-beta1/

28327.diff removes the featured image meta box for contributors. Administrators still see the box and all seems well when setting a featured image. I did not test with other roles. Looks good. Other tickets to improve error messages for this flow and video upload flow would be great.

Last edited 3 years ago by SergeyBiryukov (previous) (diff)

This ticket was mentioned in IRC in #wordpress-dev by rboren. View the logs.


3 years ago

#10 @SergeyBiryukov
3 years ago

#29113 was marked as a duplicate.

#11 @SergeyBiryukov
3 years ago

  • Keywords has-patch commit added
  • Milestone changed from Awaiting Review to 4.0
  • Version changed from trunk to 2.9

So, contributors cannot upload new images by default, and cannot use existing images either, since wp_ajax_query_attachments() requires upload_files capability.

28327.diff looks good to me.

#12 @SergeyBiryukov
3 years ago

Since we don't show the Add Media button if the user cannot upload files, I guess there's no point in calling wp_enqueue_media() either. See 28327.2.diff.

#13 @wonderboymusic
3 years ago

  • Owner set to wonderboymusic
  • Resolution set to fixed
  • Status changed from new to closed

In 29402:

Don't show the Featured Image metabox for users with the contributor role. Do enqueue media so that TinyMCE previews work for YouTube embeds, etc.

Props SergeyBiryukov.
Fixes #28327.

#14 @SergeyBiryukov
3 years ago

The props should have gone to MikeHansenMe.

Note: See TracTickets for help on using tickets.