Make WordPress Core

Opened 6 years ago

Closed 3 years ago

#44666 closed defect (bug) (invalid)

Don't use hardcoded delete_post capability for custom post types

Reported by: swissspidy's profile swissspidy Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Posts, Post Types Keywords: needs-patch
Focuses: administration Cc:


The post list table as well as the publish meta box use the delete_post capability to check whether a user can delete or trash a post.

However, when registering a post type with a custom capability base, e.g. product, the actual capability will be delete_product.

The same goes for the capability check inside attachment_submit_meta_box() and perhaps other places too.

Related: #30991.

Change History (2)

#1 @swissspidy
6 years ago

get_delete_post_link() has the same wrong check apparently.

#2 @swissspidy
3 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to invalid
  • Status changed from new to closed

Invalid, since this is handled by map_meta_cap

Note: See TracTickets for help on using tickets.