Replace `publish_posts` permission check in `wp_insert_post()`.

[peterwilsoncc]

wp_insert_post() includes a permission check to prevent contributors from setting the slug:

// Don't allow contributors to set the post slug for pending review posts.
if ( 'pending' == $post_status && ! current_user_can( 'publish_posts' ) ) {
	$post_name = '';
}

To ensure WP is checking permissions against the correct post type, the check should be changed to the following for new posts:

current_user_can( get_post_type_object( /**/ )->cap->publish_posts )

For post updates, the check should be changed to:

current_user_can( 'publish_post', $postID )

Tests will need to include:

• CPTs mapping meta caps
• CPTs not mapping meta caps
• CPTs using custom caps (eg cpt_publish_posts) with various user roles
• CPTs not using custom caps
• core post types

[skostadinov]

I changed the current_user_can with the post_ID.

[peterwilsoncc]

@skostadinov Thanks for your initial patch, unfortunately it's a little more complex as we need to allow for new and updated posts and custom post types.

In 42464.diff​:

• when updating posts, the meta capability is checked with the post ID
• for new posts, the primitive capability is checked for the post type

Various tests:

• CPTs with and without mapped meta caps, both use custom capability types
• contributor setting the post slug of a core post post type
• administrator attempting to set the post slug of a CPT in which they don't have permissions (this would previously fail)

[peterwilsoncc]

In 42464.2.diff​:

• Refreshed against coding standards
• Updated to include @johnbillion's feedback

[johnbillion]

42464.3.diff​ adds a tearDownAfterClass() method to remove the post type caps added to the admin role. Without this, the Tests_User_Capabilities::test_all_caps_of_users_are_being_tested() and Tests_User_Capabilities::testPrimitiveCapsTestsAreCorrect() rightly fail. Also tweaked the test names and switched to assertSame() as we're dealing with empty strings.

[johnbillion]

In 42380:

Role/Capability: When checking capabilities before setting a post slug, ensure the correct post type capabilities are used.

Previously, only the publish_posts capability was checked. Now, the correct meta or primitive capability for the post type is used where appropriate.

Props peterwilsoncc

Fixes #42464

[peterwilsoncc]

Bumping this back to 5.1 is scheduled to be released very soon and 5.0.3 is intended to be for bug fixes rather than bug fixes and minor enhancements.

[johnbillion]

#52023 was marked as a duplicate.