Saving post can remove its hierarchical terms if user cannot 'assign_terms'

[dlh]

If a user lacks the assign_terms capability for a hierarchical taxonomy, and the user visits the edit-post screen or uses Quick Edit, the default UI still displays the checklist of terms for that taxonomy but with each input disabled.

However, disabled checkboxes are not submitted with forms. If terms in the taxonomy are selected for the post and the user saves it, 0 is submitted instead of those terms, and the relationships are lost.

To replicate:

1. Create a post as an administrator, assign it categories, and save.

2. Remove your ability to assign terms:

add_filter( 'register_taxonomy_args', function ( $args ) {
	$args['capabilities']['assign_terms'] = 'do_not_allow';
	return $args;
} );

3. Go to the edit-post screen for your post. The category checklist appears with your saved terms still checked, but the inputs are disabled.

4. Save the post. Now, only the default category is assigned.

The attached patch is the start of one potential solution: Outputting hidden fields in Walker_Category_Checklist::start_el() to match disabled, checked ones. Something similar would have to happen for Quick Edit.

But there are other approaches, and I might be misdiagnosing the issue, so I thought I would wait for more discussion before attempting to patch further.

[boonebgorges]

Oof, good find, @dlh.

A more appropriate approach, I think, is to do an 'assign_terms' cap check before saving term data on the post. (The hidden input field trick can be bypassed by manipulating the DOM.)

[johnbillion]

I think the solution here is to not output the hidden post_category[] (or tax_input[$tax]) input, which is in place so saving of the terms is triggered when no checkboxes are selected.

Refs (there may be more):

• https://core.trac.wordpress.org/browser/tags/4.4.2/src/wp-admin/includes/class-wp-posts-list-table.php?marks=1387#L1384
• https://core.trac.wordpress.org/browser/tags/4.4.2/src/wp-admin/includes/meta-boxes.php?marks=505#L501

[dlh]

Thanks @boonebgorges and @johnbillion.

As I understand them, your suggestions aren't mutually exclusive. Adding the capability check seems like it would be worth considering independently of this particular ticket, even.

Unless one of you or someone else has a preference about it, I can work on patches for both approaches.

[boonebgorges]

@dlh Sure, please go ahead with two different patches. Thanks!

[boonebgorges]

In 37691:

Taxonomy: More specific cap check when processing category data on post save.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37759:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 4.5 branch.

Props dlh.
Fixes #36379.
Please enter the commit message for your changes. Lines starting

[boonebgorges]

In 37767:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 4.4 branch.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37771:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 4.3 branch.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37776:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 4.2 branch.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37781:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 4.1 branch.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37782:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 4.0 branch.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37784:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 3.9 branch.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37787:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 3.8 branch.

Props dlh.
Fixes #36379.

[boonebgorges]

In 37788:

Taxonomy: More specific cap check when processing category data on post save.

Ports [37691] to the 3.7 branch.

Props dlh.
Fixes #36379.