Context Navigation

← Previous Ticket
Next Ticket →

#44055 closed defect (bug) (fixed)

Don't show notice to the privacy policy guide when user cannot view the guide

Reported by:	ocean90	Owned by:	azaozz
Priority:	high	Milestone:	4.9.6
Component:	Privacy	Version:	5.1
Severity:	normal	Keywords:	gdpr dev-reviewed
Cc:		Focuses:

Description

The privacy policy guide is only viewable if current_user_can( 'manage_privacy_options' ) but WP_Privacy_Policy_Content::notice() has no such check, leading an editor to an empty page.

Change History (13)

#1 @azaozz
8 years ago

Priority normal → high

I'm actually not sure if editors on "single" installs should not be able to see the privacy policy guide? Generally they are trusted as much as admins (have unfiltered_html capability, etc.).

In any case, the notice should have the same capability requirement as the guide.

Last edited 8 years ago by azaozz (previous) (diff)

#2 @azaozz
8 years ago

Owner set to azaozz
Resolution → fixed
Status new → closed

In 43248:

Privacy: require manage_privacy_options capability for showing WP_Privacy_Policy_Content::notice().

Props ocean90.
Fixes #44055.

#3 @azaozz
8 years ago

Resolution fixed
Status closed → reopened

Reopen for 4.9.6 consideration.

#4 @azaozz
8 years ago

Keywords fixed-major commit added; needs-patch removed

#5 @iandunn
8 years ago

Keywords 2nd-opinion added

Hmm, should editors be allowed to edit the wp_page_for_privacy_policy ? I'm guessing no, so maybe a better solution to this would be to add a map_meta_cap callback that makes current_user_can( 'edit_post', get_option( 'wp_page_for_privacy_policy' ) ) return false?

This ticket was mentioned in Slack in #core by desrosj. View the logs.

8 years ago

#7 @iandunn
8 years ago

Keywords 2nd-opinion removed

I opened #44079 to track the suggestion in comment:5. If we can get that in before the RC2 deadline, then there's no need to backport r43248. Otherwise, I don't have any objection to backporting it (although I haven't reviewed it yet, so it'll still need a review and sign-off from a 2nd committer).

This ticket was mentioned in Slack in #gdpr-compliance by allendav. View the logs.

8 years ago

#9 @iandunn
8 years ago

Keywords dev-feedback added

This ticket was mentioned in Slack in #gdpr-compliance by azaozz. View the logs.

8 years ago

#11 @iandunn
8 years ago

Resolution → fixed
Status reopened → closed

In 43277:

Privacy: require manage_privacy_options capability for showing WP_Privacy_Policy_Content::notice().

Props ocean90.
Merges [43248] to the 4.9 branch.
Fixes #44055.

#12 @iandunn
8 years ago

Keywords dev-reviewed added; fixed-major commit dev-feedback removed

Nevermind regarding comment:7, it's a good idea to leave the cap check, see ticket:44079#comment:7.

#13 @desrosj
8 years ago

Component Administration → Privacy

Moving to the new Privacy component.

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core

Context Navigation

#44055 closed defect (bug) (fixed)

Don't show notice to the privacy policy guide when user cannot view the guide

Description

Change History (13)

#1 @azaozz 8 years ago

#2 @azaozz 8 years ago

#3 @azaozz 8 years ago

#4 @azaozz 8 years ago

#5 @iandunn 8 years ago

This ticket was mentioned in ​Slack in #core by desrosj. ​View the logs. 8 years ago

#7 @iandunn 8 years ago

This ticket was mentioned in ​Slack in #gdpr-compliance by allendav. ​View the logs. 8 years ago

#9 @iandunn 8 years ago

This ticket was mentioned in ​Slack in #gdpr-compliance by azaozz. ​View the logs. 8 years ago

#11 @iandunn 8 years ago

#12 @iandunn 8 years ago

#13 @desrosj 8 years ago