read_post_meta should be a meta capability

[rmccue]

Right now, we have edit_post_meta, delete_post_meta, and add_post_meta. In order to be able to expose metadata publicly, we need to be able to check if we can access individual keys.

is_protected_meta only controls whether it's prefixed and should default to being protected (by default, prefixed with _). This isn't adequate to check for read permission on a key, because it's not filterable.

[rachelbaker]

Moving out of 4.2 milestone since this needs discussion and a patch.

[swissspidy]

@rmccue @rachelbaker I suppose this was asked regarding the REST API? How is this currently handled there?

Having a read_post_meta capability seems legit to me.

Trac Ticket : Core-29786

## Description:

• This pull request addresses the need for more granular control over metadata access in WordPress by introducing the read_post_meta capability. Currently, the existing capabilities for editing, deleting, and adding post metadata (edit_post_meta, delete_post_meta, and add_post_meta) do not provide a mechanism to determine if specific metadata keys can be accessed publicly.

## Problem Statement

• The current implementation relies on the is_protected_meta function, which only checks if a meta key is prefixed (usually with an underscore). This does not adequately control access permissions for individual metadata keys, as it lacks the flexibility to allow or deny access based on custom conditions. Consequently, metadata that should be exposed publicly may inadvertently remain restricted, leading to potential issues with transparency and accessibility.

## Proposed Solution

• The proposed implementation introduces the read_post_meta capability, allowing developers to define access permissions for specific metadata keys. This new capability utilizes filters to assess whether a user has permission to read a given meta key associated with a post. It checks the following:

• Ensures that the requested post exists and is accessible.

• Validates the post type and its associated capabilities.

• Applies filters for individual meta keys, providing a flexible and extensible mechanism to control access.

• This enhancement not only adheres to WordPress coding standards but also promotes better security practices by allowing more nuanced permissions for accessing metadata.

## Impact

• Improved Access Control: The ability to control access to individual metadata keys enhances security and flexibility in handling metadata.

• Customizability: Developers can leverage the provided filters to implement custom permission checks tailored to their specific use cases.

• Consistency: This approach aligns with existing capabilities in WordPress, ensuring a cohesive experience for developers.

• Public Data Exposure: The implementation facilitates safe exposure of necessary metadata while restricting access to sensitive information.

##

This pull request is a step toward making metadata handling more robust and user-friendly in WordPress, fostering a more secure environment for managing and exposing post metadata.