Implement enhanced post_status transition capabilities

[derweili]

WordPress has some publishing related capabilities for post types including:

publish_posts, edit_published_posts

While working on multiple project with some custom user roles and while working on #47443 I noticed there could be some use cases that require more capabilities based on posts-status-changes.

Example use case

When a user has the edit_published_posts but not publish_posts capability they can edit an already published posts but not publish a new posts/draft post.

By editing a published post they can (accidentally) unpublish a post. If they did this by mistake, they don't have the possibility to revert this change.

In most scenarios this is not intended.

I can think about two ways how to solve this problem.

Solving this problem with an additional post type capability

So I think an additional capability could be added which is responsible from switching from a published post_status to an unpublished status.

Solving this problem using filter hooks

Because the solution is a bit unflexible I could also think about implementing a similar functionality by introducing one or more filter hooks like:

• can_transition_post_status with a boolean value and the current and new status as additional arguments
• can_transition_{old_status}_to_{new_status} with a boolean value and the post id as an additional argument

Those filter hooks could be similar to the post transition action hook ​https://codex.wordpress.org/Post_Status_Transitions
But those filters would run before updating the post.

[johnbillion]

Thanks for the report. Under what situation can a user without edit_published_posts make a change to the post which causes it to revert to draft? Can you provide the steps to reproduce that without any plugins active?

[derweili]

@johnbillion a user without edit_published_postscan't make a change to a publish post to revert the publish status. But a user with edit_published_posts AND without publish_posts can (accidentally) revert the post to draft (unpublish the post). If they did this by mistake they can't re-publish the post because they don't have the publish_posts capability.

If I would like to have a user that can only edit published posts but don't want to give them the possibility to unpublish it, there is no officiall solution / hook to do this.

Furthermore, the ability to limit specific status-changes to e.g. specific users would empower plugins to implement advanced publishing workflows like:

draft -> proof-reading -> SEO review -> final-review -> published
(each status transition requires a different type of user)

Although implementing such a workflow is plugin territory WordPress could provide dedicated filter hooks to let plugins filter which status changes are allowed and which not.

There are many more use cases that could be implemented if we had such "can_change_status filters".