delete_private_posts capability doesn't prevent user from deleting private posts

[yboris]

Attempting to prevent users from deleting a published post works, but if they set a post to 'private' they can delete it even if 'delete_private_posts' capability is set to 0.

<?php
global $current_user;
// works
$current_user->allcaps['delete_published_posts'] = 0;
// doesn't work
$current_user->allcaps['delete_private_posts'] = 0;

"doesn't work" means that "Trash" link appears on hover over the post in edit.php and "Move to Trash" shows up on post.php

[yboris]

The above "global $current_user" was a shorthand of:

<?php
$current_user = wp_get_current_user();
$current_user->allcaps['delete_published_posts'] = 0;
$current_user->allcaps['delete_private_posts'] = 0;

[johnbillion]

Thank you for your report, @yboris. Sorry that it's taken such a long time before anybody responded.

I'm looking into this as part of several other related fixes.

[debarghyabanerjee]

I can reproduce the issue in version 6.7.1 as well. I’ve reviewed the codebase but couldn’t pinpoint the cause. I’ll continue investigating to find the root cause.

Trac ticket: https://core.trac.wordpress.org/ticket/38997