Unifying permission error messages

[ramiy]

Ok, so we have many many many types of error messages. In this ticket I will try to fix/unify the use of the You are not allowed to ... strings.

See the strings:

• ​dev strings
• ​admin strings
• ​network strings

As you can see in the links above, the majority of the strings are using the You are not allowed to ... prefix. But some strings use other prefixes:

• You are not allowed to ... - the most popular prefix
• Sorry, you are not allowed to ...
• Sorry, you do not have the right to ...
• Sorry, you cannot ...

I noticed that the Sorry, prefix is used only in class-wp-xmlrpc-server.php file. In the attached patch, I've removed the Sorry, prefix to create a unified error message changing and updating the different prefixes mentioned above.

---

Note: WordPress has many types of error messages, in this ticket I'm trying to unify the error messages that you usually see after the if ( ! current_user_can( 'xxx' ) ) check.

[ramiy]

Other error messages I found:

• You don't have permission to ...
• You do not have permission to ...
• You do not have sufficient permissions to ...

Do you think we need to change all of them to You are not allowed to ... ???

[swissspidy]

Just noticed that You are not allowed to stick this post. sounds weird. In the admin, core uses Make this post sticky.

You are not allowed to stick this post. (and similar) should probably be changed to You are not allowed to make this post sticky..

Do you think we need to change all of them to You are not allowed to … ?

Unifying these error messages seems like a good thing to me.

[ramiy]

make this post sticky

[ramiy]

Replying to swissspidy:

You are not allowed to stick this post. (and similar) should probably be changed to You are not allowed to make this post sticky..

Done!

Any more feedback?

[swissspidy]

Replying to ramiy:

Replying to swissspidy:

You are not allowed to stick this post. (and similar) should probably be changed to You are not allowed to make this post sticky..

Done!

Any more feedback?

There's also You are not allowed to stick a private post. with the same problem :) Probably other strings too, though I can't find any right now.

[ramiy]

make this post private

[ramiy]

Replying to swissspidy:

There's also You are not allowed to stick a private post. with the same problem :) Probably other strings too, though I can't find any right now.

Done!

Didn't find any more stick strings.

[DrewAPicture]

I think I prefer "Sorry, you are not allowed to ..." over "You don't/do not have permission to ...".

For that matter, we should probably use "Sorry, you aren't allowed to ..." to match existing style elsewhere, see [34987] for more on that.

[ramiy]

Replying to DrewAPicture:

I think I prefer "Sorry, you are not allowed to ..." over "You don't/do not have permission to ...".

For that matter, we should probably use "Sorry, you aren't allowed to ..." to match existing style elsewhere, see [34987] for more on that.

Not sure about the Sorry part, only the class-wp-xmlrpc-server.php file uses this prefix, all the other files did not.

As for [34987], I changed 152 strings all over the core to use aren’t.

[SergeyBiryukov]

#14039 was marked as a duplicate.

[maor]

+1.

I love this idea of standardizing the various error messages. Also, this is a personal opinion, but I do not like the wording for the kind of errors that begin with Sorry, .... Nothing to be sorry for ;)

[nir_r]

Thanks Rami for taking care of unifying the error messages...

[Compute]

+1 for the work Rami has done here! Hope this idea gets into core.

[SergeyBiryukov]

@DrewAPicture: Any objections to 34521.patch​?

[DrewAPicture]

Replying to SergeyBiryukov:

@DrewAPicture: Any objections to 34521.patch​?

I like where this is going. In reviewing the strings I noticed a few minor issues:

• This message in wp-admin/network/sites.php is strangely non-specific compared to most of the others: "You aren't allowed to delete the site."
• Some of the IXR_Error strings don't end with periods, some do. Seems like maybe we should be consistent.
• I notice a few strings include the mildly unhelpful phrase, "Something wrong happened." Not sure if we want to try fixing that here or separately

[ramiy]

Replying to DrewAPicture:

I like where this is going. In reviewing the strings I noticed a few minor issues:

• This message in wp-admin/network/sites.php is strangely non-specific compared to most of the others: "You aren't allowed to delete the site."
• Some of the IXR_Error strings don't end with periods, some do. Seems like maybe we should be consistent.
• I notice a few strings include the mildly unhelpful phrase, "Something wrong happened." Not sure if we want to try fixing that here or separately

Thanks for the feedback Drew.

• In this ticket I'm not trying change the strings meaning. Just to unify the prefix.
• This is a very good point! I will add periods to all the strings.
• I prefer to address this in a separate ticket.

[adamsilverstein]

@DrewAPicture & @SergeyBiryukov: Do you see any issues with this change? I'm assuming part of the goal here in standardizing the language is to make it easier on translators. This makes sense to me. Also, I'm not sure I like the encoded ampersands, i would almost go with 'are not' instead of aren't to avoid them (although I do see @drew commented on matching other language with that above). What do you think @ocean90?

[pavelevap]

I like this change very much as a translator, but:

• Current error messages are also well indexed for example by Google, users can struggle to debug new strings.
• XML-RPC will be removed as a whole in the future so this problem mostly disappears at all?

[ocean90]

Current error messages are also well indexed for example by Google, users can struggle to debug new strings.

Since they will be still similar that's not really an issue.

XML-RPC will be removed as a whole in the future so this problem mostly disappears at all?

Not sure where you have read that, but there is no reason for removing it.

---

I did a quick poll on Slack at ​https://wordpress.slack.com/archives/core/p1455746910000403. 5 votes for "You are not allowed to edit this post." and 11 for "Sorry, you are not allowed to edit this post.". Since "Sorry, " is a pretty common pattern in core we should go with "Sorry, you are not allowed…". (Keep in mind that translators don't have to translate "Sorry".)

[pavelevap]

You can check for example following search (Google):

• You are not allowed to edit this page. - current message, many exact search results from wordpress.org or SE.

• You aren’t allowed to edit this page. - proposed message, nothing relevant found.

Removing XML-RPC was mentioned probably somewhere in Trac (after adding REST API), but I am not sure about it, maybe it was only mentioned idea which was later denied.

What about adding translators comment, that these strings are wp_die() related? It could be helpfull for translators to know context.

[ocean90]

Is anyone working on a refresh?

[ramiy]

Guys, you are forgetting that those are not general error messages, it's only permission messages. They come after !current_user_can('xxx'), when the user don't have sufficient permissions to do something.

Maybe we should consider using:

• You don't have permission to ...
• You do not have permission to ...
• You don't have sufficient permissions to ...
• You do not have sufficient permissions to ...

[ocean90]

Still needs a patch based on the decision from comment:26, punting for now.

[Presskopp]

Refresh.

Please double-check with me, I just saw 2 mistakes :(

wp-admin/includes/file.php

wp-admin/custom-background.php

[ocean90]

@Presskopp Thanks for the refresh!

34521.3.patch​:

• Please avoid any code styling changes like in wp-admin/custom-background.php.
• Docs shouldn't be changed, see wp-admin/includes/file.php and wp-includes/deprecated.php.
• "You cannot" shouldn't be replaced with "Sorry, you are not allowed". There is no way that you can perform the action. Let's leave these string as is.
• In wp-includes/class-wp-xmlrpc-server.php "Sorry" is added twice: "Sorry, Sorry, …"

[Presskopp]

Ok, thank you, I will do these corrections..

[ocean90]

@Presskopp Please make sure that you always add a comment after uploading a patch since attachments don't trigger notifications.

[ocean90]

In 37914:

Text Changes: Unify permission error messages.

The new format looks like "Sorry, you are not allowed to <action>.". This provides a consistent experience for all error messages related to missing permissions. It also reduces the number of similar strings and allows translators to provide a consistent style in their language.

Props ramiy, Presskopp.
Fixes #34521.

[SergeyBiryukov]

In 37956:

Text Changes: Remove duplicate string, use the one we already have.

See #34521.

[SergeyBiryukov]

In 37958:

Text Changes: Remove duplicate string, use the one we already have.

See #34521.

[ramiy]

Great work @SergeyBiryukov, I've seen those duplicates too. You there are few more you have missed: ​https://translate.wordpress.org/projects/wp/dev/admin/ru/default?filters%5Bterm%5D=you+are+not+allowed&filters%5Buser_login%5D=&filters%5Bstatus%5D=current_or_waiting_or_fuzzy_or_untranslated&sort%5Bby%5D=original&sort%5Bhow%5D=desc&sorts=Sort

[SergeyBiryukov]

In 37960:

Text Changes: Remove duplicate string, use the one we already have.

See #34521.

[SergeyBiryukov]

@ramiy: Thanks! I think the changesets above caught all the duplicates (in the scope of this ticket). If you find more, let me know :)

[ramiy]

Needed text changes

[ramiy]

@SergeyBiryukov, the screenshot has few more changes.

---

I also think we should either remove the suffix or unify the suffix in those strings.

The current structure: Sorry, you are not allowed to <action><suffix>.

Action examples:

• add posts/pages/comments
• edit posts/pages/comments/themes/plugins
• delete posts/pages/comments/themes/plugins
• manage themes/plugins/options
• install themes/plugins

Suffix examples (currently in use):

• on this site
• for this site
• in this site
• of this site
• as this user

I personally think, in most case, we can ditch the suffix.

In other cases, where we use "to this network", we should not remove the suffix.

But we can definitely remove "as this user" suffix.

[ramiy]

Text change: import content

[ramiy]

Text change: export content

[ramiy]

Text change: edit links

[ramiy]

Text change: manage options

[ramiy]

Text change: manage options

[ramiy]

Text change: add categories

[ramiy]

"Sorry, you cannot" --> "Sorry, you are not allowed"

[ramiy]

Found 16 more strings.

"Sorry, you cannot..." --> "Sorry, you are not allowed..."

See my last patch.

[ramiy]

"Sorry, you can not" --> "Sorry, you are not allowed"

[ramiy]

update permission string

[ramiy]

Text change: manage users - on XMLRPC blogger_getUserInfo() function

[ocean90]

In 37998:

Import: Merge two similar strings.

Props ramiy.
See #34521.

[ocean90]

• 34521-text-change-export.patch​: The current string looks fine as is.
• 34521-text-change-bookmarks.patch​: The current string looks fine as is.
• 34521-text-change-manage-options.patch​: The proposed change is invalid, it's not about managing options.
• 34521-text-change-add categories.patch​: The proposed change is invalid, the API allows only one category to add.
• 34521-text-change-manage-users.patch​: The current string looks fine as is, it's about retrieving your data, not managing users.
• 34521-one-more-permission-string.patch​: The current string looks fine as is.

[ocean90]

In 37999:

Text Changes: Unify a few more permission error messages which were missed in [37914].

Props ramiy.
Fixes #34521.

[ramiy]

you are not allowed to access user data

[ramiy]

Thank for the review @ocean90, I have a few notes:

Imports / Exports

For "imports" we are using "Sorry, you are not allowed to import content."

This is why the "export" should use "Sorry, you are not allowed to export content."

Patch: 34521-text-change-export.patch​

Manage Users

The blogger_getUserInfo() function in wp-includes/class-wp-xmlrpc-server.php is checking for user permission using current_user_can() function. The patch 34521-text-change-manage-users.2.patch​ is fixing the permission error message using the new standard - "you are not allowed to...".

replacing "Sorry, you do not have access to user data on this site."

with this "Sorry, you are not allowed to access user data on this site."

Looks like a minor change, but it's what ticket is meant to do - minor changes all over the core.

API Permissions

As mentioned in the second comment, we replaced all the string saying:

• You don't have permission to ...
• You do not have permission to ...
• You do not have sufficient permissions to ...

The rest-api is the last string using the old format.

34521-one-more-permission-string.patch​ is updating this string. The patch replacing the text and merging the string with other similar string - "Sorry, you are not allowed to do that.", it is used twice in wp-includes/script-loader.php.

[ocean90]

In 38037:

Text Changes: Unify/merge two more permission error messages.

Props ramiy.
Fixes #34521.

[ocean90]

Replying to ramiy:

For "imports" we are using "Sorry, you are not allowed to import content."

This is why the "export" should use "Sorry, you are not allowed to export content."

Patch: 34521-text-change-export.patch​

IMO the current string reads much better than your proposal. I'd probably change the content string but let's call it done for 4.6.

[SergeyBiryukov]

In 38665:

Text Changes: Unify two permission error messages in wp-admin/network/site-users.php.

Props ramiy.
Fixes #38178. See #34521.

[SergeyBiryukov]

In 38666:

Text Changes: Unify two more permission error messages.

Props ramiy.
Fixes #38158. See #34521.

[SergeyBiryukov]

In 39251:

REST API: Unify permission error messages.

Props ramiy.
See #38791, #34521.

[SergeyBiryukov]

In 39253:

Text Changes: Unify permission error message in wp-ajax-response.js.

See #34521.

[ramiy]

More strings for WordPress 4.7 Rest API in #38803.

[JeffPaul]

#33453 was marked as a duplicate.