users without 'edit_posts' capability never get informed that their uploads succeed

[pbiron]

Steps to reproduce:

1. create a user with upload_files capability but not edit_posts capability
2. login as that user
3. upload a media file
4. notice that the status of the upload stays at Crunching...
5. notice also that the filename/post_title eventually ends up blank

Expected behavior:

1. user gets some sort of "Success" notification (analogous to the Edit link that users with edit_posts capability get)

I discovered this problem on a site with users whose role is basically Subscriber but with upload_files capability. The problem is that /wp-admin/async-upload.php contains:

<?php
if ( ! current_user_can( 'edit_post', $id ) )
        wp_die( __( 'Sorry, you are not allowed to edit this item.' ) );

My current workaround is to hook into ​user_has_cap and add edit_posts IFF edit_post is being checked from async-upload.php and its an attachment whose post_author is the current user. This workaround is not ideal (because I don't want these users to be able to edit the attachment), but at least they know the upload succeeded.

[pbiron]

this is what users without 'edit_posts' capability see after their upload has succeeded

[pbiron]

this is what users with 'edit_posts' capability see after their upload has succeeded

[pbiron]

report "Success" for users without 'edit_post' capability

[pbiron]

this is what users without 'edit_posts' capability see after their upload has succeeded after 44581.diff is applied

[joemcgill]

I want to take a hard look at the capabilities changes to make sure there aren't any issues with this change, but seems sensible.

[SergeyBiryukov]

Previously: #8234

[pbiron]

Replying to joemcgill:

I want to take a hard look at the capabilities changes to make sure there aren't any issues with this change, but seems sensible.

Just to be clear, the patch does not change any caps...it simply removes the wp_die() when the user doesn't have edit_posts and instead outputs something different in that case.

[kirasong]

Refresh of 44581.diff.

[kirasong]

Refreshed the patch in 44581.2.diff​.

As we're right before beta for 5.3 and this hasn't seen movement, moving this to Future Release.

Am interested in seeing this fixed, but would appreciate someone double-checking that nothing unintentional happens when removing the wp_die() noted.

[pbiron]

Related: #19834, #41332

[rebasaurus]

Thanks for the patch @pbiron. Works as expected on a clean install!

[pbiron]

Thanx for testing @rebasaurus!

[whyisjake]

In 48128:

Media: Ensure that uploaded images get a success notification by users with upload_files capability.

There was an early wp_die that was preventing the success notification from being sent in the upload process.

Fixes #44581.

Props pbiron, mikeschroder, joemcgill, rebasaurus, whyisjake.