Cannot access 'Manage menus' in Navigation block toolbar when running a classic theme

[noisysocks]

Originally reported in ​https://github.com/WordPress/gutenberg/issues/38118.

(Re)discovered while testing ​https://github.com/WordPress/gutenberg/pull/38168.

Steps to reproduce:

1. Activate a classic theme.
2. Create or edit a post or page.
3. Create or select a Navigation block.
4. In the toolbar, select _Select menu_.
5. Select _Manage menus_.
6. You get a "Sorry, you are not allowed to edit posts in this post type." error.

The Navigation block is supported in both block themes and classic themes, so it is incorrect to only allow access to
edit.php?post_type=wp_navigation when the current theme is a block theme.

This fixes a bug where clicking on 'Manage menus' in the toolbar of a Navigation block takes you an error page when running a classic theme.

Trac ticket: https://core.trac.wordpress.org/ticket/54889

[noisysocks]

@hellofromTonya This is a separate issue that came up while testing the fix for ​https://github.com/WordPress/gutenberg/issues/38166. I don't believe it's particularly high priority as it only affects classic themes but it's an easy fix so maybe we should include it in RC 4. Your call.

[noisysocks]

Moving to 5.9 for visibility. Again, I'm not sure if it's 5.9 or 5.9.1.

[costdev]

Test Report

Env

• WordPress: trunk and ​PR 2219
• Chrome 97.0.4692.71
• Windows 10
• Theme: Twenty Twenty-One
• Block Editor
• Plugin: None activated

Steps to test

As an administrator:

1. Navigate to Posts > Add New.
2. Insert a Navigation block.
3. Click Select menu.
4. Select a menu.
5. Click Select menu.
6. Click Manage menus.
7. The following is displayed: Sorry, you are not allowed to edit posts in this post type.
8. Apply ​PR 2219.
9. Repeat steps 1-6.
10. The Navigation Menus screen should appear.
11. Repeat steps 1-5 as an editor.
12. The Manage menus option should not be available.

Expected results (✅/❌)

• ​PR 2219 should grant access to the Navigation Menus screen for administrators when selecting Manage menus. ✅
• ​PR 2219 should hide the Manage menus option from editors. ✅
• ​PR 2219 should continue to display a permissions notice to editors when browsing directly to wp-admin/edit.php?post_type=wp_navigation. ❌

Notes

Editors can still manually browse to wp-admin/edit.php?post_type=wp_navigation. This shows the Navigation Menus screen and the available menus but does not allow them to interact with the items. The Bulk Edit dropdown is available, but does nothing.

[hellofromTonya]

I can confirm the fix does allow administrator to access to screen. However, as @costdev noted, it now also allows access to the editor capability via URL.

An editor does not have access to the classic Menus screen (Appearance > Menus) via direct /wp-admin/nav-menus.php URL or from the sidebar menus.

Though the fix does resolve the original reported issue, it needs to also deny access to non-admins.

Moving to 5.9.1.

[talldanwp]

I can confirm the fix does allow administrator to access to screen. However, as @costdev noted, it now also allows access to the editor capability via URL.

In my testing, this patch doesn't introduce this issue. It seems to already be present in 5.9 for editors using a block theme.

[manfcarlo]

There are 12 capability keys that a post type can set upon registration, and the wp_template and wp_template_part post types set all of them. I notice that wp_navigation (and also wp_global_styles) are missing some. Maybe this is why the access is not working correctly?

[ironprogrammer]

Following @manfcarlo's train of thought, adding the edit_posts capability to the wp_navigation post type registration does enforce the restricted access that is expected on the Navigation Menus edit page. It is no longer accessible by non-admins. That addition could be added to @noisysocks's PR.

Related Issue
While I believe it to be separate, this is worth mentioning here, as it will come up during testing, whether or not the above adjustments make it into this patch.

The following issues were observed when interacting with Navigation blocks as a non-admin (tested: editor and author).

• Without the fix applied, in both 5.9 and trunk, non-admins have the ability to add, edit, and remove Navigation blocks. I don't believe this is by design (there are several "toast" warnings to this effect).
• With the fix applied, when a Navigation block is present, its block may be replaced with the warning: Navigation menu has been deleted or is unavailable. Create a new menu? Clicking "Create a new menu?" allows some basic tinkering with the Navigation block (e.g. alignment, colors, styles), which can be saved. After saving by a non-admin, the block appears as a "placeholder", but with styling applied.

I'm trying to track down if this has been recorded in Gutenberg issues, where I'll post additional details.

[pyrobd]

Not able to reproduce the issue in 5.9 any suggestions

[ironprogrammer]

Hi, @pyrobd: I was able to reproduce with @noisysocks's repro steps, as well as @costdev's test report. Note that the active theme needs to be "classic", or non-block.

I've attached a video that exhibits an admin user's permissions check failure on /wp-admin/edit.php?post_type=wp_navigation when attempting to "Manage menus" from the block editor. I used an existing menu for brevity, but the same happens regardless of actions taken in the block editor, since the permissions are really failing on the wp_navigation post type edit screen.

[ironprogrammer]

Screencast exhibiting error condition: admin unable to "Manage menus" from block editor

Adds a post type registration capabilities check to prevent non-admin users from accessing the Navigation Menus edit screen.

This change is in conjunction with ​the original PR submitted by @noisysocks.

Trac ticket: https://core.trac.wordpress.org/ticket/54889

[ironprogrammer]

Submitted new PR (​PR 2327) amending original PR (​PR 2219) from @noisysocks so we have a consolidated patch. Adds the post type capability check mentioned here.

Also added has-screenshots keyword reflecting addition of screencast of error condition.

[noisysocks]

@ironprogrammer's PR looks good to me.

[hellofromTonya]

Test Report

Env:

• WP: trunk with the PR 2327
• OS: macOS Big Sur
• Localhost: wp-env
• Browsers: Edge, Chrome, Firefox, Firefox Dev, Safari
• Theme: TT2 and TT1
• Plugins: none

Steps

• Step 1: Log in as an admin
• Step 2: Create contributor and editor users
• Step 3: Go to ​http://localhost:8889/wp-admin/edit.php?post_type=wp_navigation. Expected result: should have access to the Navigation Menus UI as the admin.
• Step 4: Log in as a contributor
• Step 5: Repeat step 3. Expected result: No access and an error message "You need a higher level of permission. Sorry, you are not allowed to edit posts in this post type."
• Step 6: Repeat steps 4 and 5 but as an editor user.

Test Results:

• Admin role: confirmed admin has access ✅
• Contributor role: confirmed does not have access ✅
• Editor role: confirmed does not have access ✅

PR is ready for commit. Self-assigning to prep commit.

[hellofromTonya]

Test Report with PR 2327 applied showing results with admin, contributor, and editor roles ✅

[hellofromTonya]

Also worth noting, prior to this fix, with a block theme activated, admin and non-admins had access to the Navigation Menus UI. After the fix, only admins have access.

Closing as ​https://github.com/WordPress/wordpress-develop/pull/2327 is preferred.

[hellofromTonya]

Reference: ​https://github.com/WordPress/gutenberg/pull/37454 for admin only permission discussion.

[hellofromTonya]

In 52755:

Editor: Grant only admins access to the "Navigation Menus" UI for block and non-block themes.

Restricts and grants access to only admin roles for the Navigation Menu UI screen, i.e. either directly through the URL wp-admin/edit.php?post_type=wp_navigation or via the Navigation block's "Manage menu" option (in the block's toolbar).

It resolves 2 issues:

• For non-block themes, fixes the issue where admins could not access the UI.
• For block themes, restricts access to only admin roles, i.e. non-admins no longer have access to the UI.

Non-admins will receive the "Sorry, you are not allowed to edit posts in this post type" error message.

Follow-up [52069], [52145], [52330], [52400].

Props ironprogrammer, costdev, noisysocks, talldanwp, hellofromTonya, manfcarlo, pyrobd.
Fixes #54889.

[hellofromTonya]

Reopening for backport to 5.9-branch for 5.9.1. Needs 2nd committer review and approval.

Committed via https://core.trac.wordpress.org/changeset/52755.

[audrasjb]

Marking as ready for backport 👍
Thanks!

[hellofromTonya]

Thanks @audrasjb! I'm prepping backport now.

[hellofromTonya]

In 52756:

Editor: Grant only admins access to the "Navigation Menus" UI for block and non-block themes.

Restricts and grants access to only admin roles for the Navigation Menu UI screen, i.e. either directly through the URL wp-admin/edit.php?post_type=wp_navigation or via the Navigation block's "Manage menu" option (in the block's toolbar).

It resolves 2 issues:

• For non-block themes, fixes the issue where admins could not access the UI.
• For block themes, restricts access to only admin roles, i.e. non-admins no longer have access to the UI.

Non-admins will receive the "Sorry, you are not allowed to edit posts in this post type" error message.

Follow-up [52069], [52145], [52330], [52400].

Props ironprogrammer, costdev, noisysocks, talldanwp, hellofromTonya, manfcarlo, pyrobd.
Merges [52755] to the 5.9 branch.
Fixes #54889.