Multisite bug with current_user_can() and subscriber

[JazZ7]

On multisite, Subscribers have upload_files permission but in wp-admin/includes/ajax-actions.php wp_ajax_upload_attachment() does not work because current_user_can() return false on line 2018 :

<?php
    if ( ! current_user_can( 'upload_files' ) ) {
        echo wp_json_encode( array(
            'success' => false,
            'data'    => array(
                'message'  => __( 'Sorry, you are not allowed to upload files.' ),
                'filename' => $_FILES['async-upload']['name'],
            )
        ) );
 
        wp_die();
    }

Thanks for your help.

[johnjamesjacoby]

On multisite, Subscribers have upload_files permission

I don't think this is accurate. Can you point to where you're seeing this capability applied or mapped?

schema.php doesn't add it to user roles, and I don't see anything in map_meta_cap().

[SergeyBiryukov]

And if you're adding the capability with your own code, could you share all the relevant code?

[JazZ7]

Thanks for your support.

Here is the code that handles the subscribers upload_files permission :
(doing this in the template for demonstration)

/wp-content/themes/my-theme/profile.php :

<?php
/*
Template Name: Page Profile
*/

$sub_role = get_role('subscriber');
$sub_role->add_cap('upload_files');
var_export($sub_role);

echo "<br /><br />";

$user_ID = get_current_user_id();
$user = new WP_user($user_ID);
var_export($user->caps);

echo "<br /><br />";

var_export(current_user_can('upload_files'));

die();

The result is :

WP_Role::__set_state(array( 'name' => 'subscriber', 'capabilities' => array ( 'read' => true, 'level_0' => true, 'upload_files' => true, ), ))

array ( 'subscriber' => true, )

true

But the ajax request returns :

{'success': false, 'data':{'message': 'Sorry, you are not allowed to upload files.', 'filename': 'filename.jpg'}}

[jeremyfelt]

Thanks for opening a ticket. This appears to be an issue with custom code in the theme rather than in WordPress core. Please feel free to comment further or reopen the ticket if this can be reproduced without plugins or a non-default theme installed.