WordPress.org

Make WordPress Core

Opened 14 months ago

Last modified 14 months ago

#44666 new defect (bug)

Don't use hardcoded delete_post capability for custom post types

Reported by: swissspidy Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Posts, Post Types Keywords: needs-patch
Focuses: administration Cc:

Description

The post list table as well as the publish meta box use the delete_post capability to check whether a user can delete or trash a post.

However, when registering a post type with a custom capability base, e.g. product, the actual capability will be delete_product.

The same goes for the capability check inside attachment_submit_meta_box() and perhaps other places too.

Related: #30991.

Change History (1)

#1 @swissspidy
14 months ago

get_delete_post_link() has the same wrong check apparently.

Note: See TracTickets for help on using tickets.