Media Grid View not respecting individual edit capabilities

[skaeser]

The attachment detail modal used in the Media Grid View does not check whether the current user is allowed to edit the displayed attachment and does always render the "Edit more details"-link and the "Edit Image"-button. This results in a "You are not allowed to edit this item." view when following "Edit more details" and a plain printed "-1" in the modal dialog when clicking "Edit Image", probably due to the above mentioned check being made on the server when requesting the image editor.

Steps to reproduce this issue:

Register a custom filter for "user_has_cap" and set the "edit_posts" capability for a specific media item to "false":

function test_individual_media_edit_capability($allcaps, $caps, $args) {
  if ( count( $args ) > 2 && in_array( 'edit_posts', $caps ) ) {
    $post = get_post( $args[2] );
    if ( $post->ID == [EXISTING ATTACHMENT ID] && $post->post_type == 'attachment' )
      $allcaps['edit_posts'] = false;
  }
  return $allcaps;
}

add_filter("user_has_cap", test_individual_media_edit_capability, 100, 3);

I am not familiar enough with the exact logic behind the Backbone MVC but managed to fix the issue using the provided patch of media-template.php.

[skaeser]

Patch for media-template.php

[SergeyBiryukov]

In 29723:

Don't display Edit links for attachments user cannot edit.

props skaeser.
fixes #29596 for trunk.

[SergeyBiryukov]

Reopening for 4.0.1 consideration.

[nacin]

In 30408:

Don't display Edit links for attachments user cannot edit.

Merges [29723] to the 4.0 branch.

props skaeser.
fixes #29596.