WordPress.org

Make WordPress Core

Opened 5 years ago

Last modified 7 months ago

#29999 new defect (bug)

update post overwrites slug if current_user is contributor

Reported by: jnhghy Owned by:
Milestone: Awaiting Review Priority: normal
Severity: minor Version: 4.0
Component: Posts, Post Types Keywords: has-patch dev-feedback
Focuses: Cc:
PR Number:

Description

The wp_update_post function calls wp_insert_post which is located in wp-includes/post.php in posts.php at lines 3168 - 3171 there is this code:

	        // Don't allow contributors to set the post slug for pending review posts.
	        if ( 'pending' == $post_status && !current_user_can( 'publish_posts' ) ) {
	                $post_name = '';
	        }


this will remove post_name if the current user is a contributor without any message or notification. This creates an issue because scripts/plugins that uses wp_upadate_post usually don't handle this case (the documentation doesn't cover this also - I would update the documentation but I'm wondering if there's no other solution).

I don't see the issues that a contributor changing the slug would create (a contributor vs an editor) anybody does?

Attachments (1)

29999.patch (2.1 KB) - added by deconf 5 years ago.

Download all attachments as: .zip

Change History (15)

#1 @jnhghy
5 years ago

  • Severity changed from normal to trivial

#2 @jayelebun
5 years ago

  • Keywords reporter-feedback added

Hey @jnhghy,

I went through in an attempt to reproduce. Here is a rundown of what I did trying to see if the post slug would disappear or if I would be blocked from updating the post slug as a contributor

  1. Save test post as a draft as contributor.
  1. Changed the title and the post slug updated successfully. Save post as pending review.
  1. Logged in as admin. Published test post. The title and post slug changes persist. Now signing out to edit title and slug as a contributor.
  1. Unpublished as admin, logged in as contributor, still able to edit both the title and post slug and both persist on save draft. Not able to reproduce this error.

Could you provide some more steps on how you're running into this issue? Have you tested this on vanilla WP? For the installation where you're seeing this issue are there any other plugins dealing with permissions?

Thanks!

#3 @jnhghy
5 years ago

@jayelebun
Hi, Thank you for your time spent on this.

Here are the steps I'm making to hit this issue:

1) Create post with contributor user and submit it for publish
2) Publish post with admin
3) Draft post with admin
4) Edit post with contributor and change slug, send for review
5) Edit post again with contributor (no slug changing option at this time), send for review again
6) check post with admin, no slug changes will be seen

I haven't tested this with vanilla WP sorry (I'm not familiar with vanila WP, a link? or is it the vanila WP plugin?)

Let me know if you need any other info or if you can confirm this issue.
Thanks

This ticket was mentioned in Slack in #core by jnhghy. View the logs.


5 years ago

#5 @SergeyBiryukov
5 years ago

  • Component changed from Role/Capability to Posts, Post Types

#6 @jnhghy
5 years ago

  • Keywords reporter-feedback removed

Also tested with a fresh install of WordPress the issue is still there in wp 4.1.1.

@deconf
5 years ago

#7 @deconf
5 years ago

I was able to replicate the issue.

29999.patch will allow contributors to edit the slug while a post is waiting for review.

Allowing contributors to edit slugs while a post is pending review also fixes this bug.

I can't see why a contributor should be restricted on changing the slug while the post is waiting for review, since he's allowed to edit it while the post is a Draft.

Last edited 5 years ago by deconf (previous) (diff)

#8 @ocean90
5 years ago

  • Type changed from feature request to enhancement

Introduced in [9055], #7805.

#9 @jnhghy
5 years ago

  • Type changed from enhancement to defect (bug)

Because of this issue info is lost so I'd leave its status as bug instead of enhancement.

Last edited 5 years ago by jnhghy (previous) (diff)

#10 @deconf
5 years ago

  • Focuses docs removed
  • Keywords has-patch dev-feedback added
  • Severity changed from trivial to minor

#11 @repenter
3 years ago

Guyz I reported this bug here: #37262

Are these bugs the same?

Last edited 3 years ago by SergeyBiryukov (previous) (diff)

#12 @SergeyBiryukov
3 years ago

#37262 was marked as a duplicate.

#14 @repenter
7 months ago

Seriously no one wants to fix this issue in wordpress?

https://github.com/WordPress/gutenberg/issues/13857

Note: See TracTickets for help on using tickets.