In 5.9 (classic) post editor the author pulldown only lists users with "edit_posts" capability

[joneiseman]

In WordPress 5.9 in the classic editor when editing a post, the “Author” pulldown only shows the administrators. In 5.8.3 it listed all of the authors (and contributors). Here’s the screenshot from 5.9 when using the classic editor: ​https://photos.app.goo.gl/zQjK441TmNKL2wJf9
It still shows all the authors (in 5.9) when I switch to the block editor. Here’s the screenshot using 5.9 with the block editor:
​https://photos.app.goo.gl/ZAiT1gdDHT9F6RLF7

In 5.8.3 it lists all of the Authors in the Author dropdown when using the classic editor:
​https://photos.app.goo.gl/qkyn4Bi3X3oDz3537

It looks like this was due to a change in the function post_author_meta_box in the file src/wp-admin/includes/meta-boxes.php
It used to display all of the authors and contributors regardless of their capabilities and now it only displays users that have the "edit_posts" capability.

Here's the commit that introduced the problem:
​https://github.com/WordPress/wordpress-develop/commit/0cf6d3e48d18b4e8cb932fa02bb82bf5de14a48c

[pyrobd]

Could not reproduce the issue, other user types like author, contributor also showing in the post edit dropdown, did I missed anything?

[joneiseman]

Hi @pyrobd
Are you using the classic editor plugin and editing with the classic editor?
See the following support forum posts to see other people that are running into the same problem: ​https://wordpress.org/support/topic/in-5-9-classic-post-editor-the-author-pulldown-only-lists-administrators-2/?view=all

[pyrobd]

Yes downloaded and activated the classic editor plugin, check this screenshot ​https://prnt.sc/26niyc9

[joneiseman]

Have you updated to WordPress 5.9? That's when the problem was introduced. Also, do those two users have the edit_posts capability?

[pyrobd]

Yes using WP 5.9 and users have default capability of the contributor role. @joneiseman

[joneiseman]

Hi @pyrobd
I created a new WordPress install and I was able to confirm what you are seeing. It works correctly on the fresh install. If I go back to my existing site and disable all the plugins and switch to the default theme, I still see the problem. I will do some more investigation to figure out why it works on a fresh install and then I will comment here afterwards.

[joneiseman]

Hi @pyrobd,

I figured out why it works on the fresh install. If you create a new user with the Contributor or Author role those users will have the "edit_posts" capability. Existing Authors and Contributos on my site don't have the "edit_posts" capability. That's why it works on a fresh install but not on my existing site. There was apparently a change made to the default Capabilities for these roles You can install the User Role Editor plugin to remove the edit_posts capability for these two users to see the problem.

[joneiseman]

The change to add the edit_posts capability to these roles was made in an earlier WordPress release (not in 5.9).

[joneiseman]

By default WordPress always gave Editors and Authors the "edit_posts" capability. I had removed this capability for those roles using the User Role Editor plugin (back in 2012). That's why I saw the problem in 5.9. Prior to 5.9 it selected the users based on the role and now it's based on the edit_posts capability. I can add a filter to work around the problem.

add_filter( 'wp_dropdown_users_args', 'my_dropdown_users_args', 10, 1 );
function my_dropdown_users_args( $query_args )
{
    $query_args['capability'] =  [];
    $query_args['roles__in'] = [ "Author", "Contributor", "Editor" ];
    return $query_args;
}

I think the administrator should be able to assign any user as the author even if that user doesn't have the edit_posts capability.

[pyrobd]

Understood the issue but still some might argue that users don't have editing permission should not be shown in the author I am not sure though.

[joneiseman]

The process used on the website is that the Editor or Administrator creates the posts on behalf of the Contributors and then uses the pulldown to select the Author. The Contributors actually never log in, they just send in the post to the Editor or Administrator. There is no need to give the edit_posts capability to Contributors.

[audrasjb]

Hello,

As per today's bug scrub, let's move this ticket back to the Awaiting review queue to take the time to discuss whether this edge case should be reintroduced or not.

Thanks for your comprehension

[pyrobd]

Replying to joneiseman:

The process used on the website is that the Editor or Administrator creates the posts on behalf of the Contributors and then uses the pulldown to select the Author. The Contributors actually never log in, they just send in the post to the Editor or Administrator. There is no need to give the edit_posts capability to Contributors.

Got it now I also agree with you, so if the patch is needed now I will be happy to contribute my first Patch here.

[jbilbro]

I'm just chiming in here to reiterate that fixing this problem would be a big help. We have been relying on a workaround for the last couple weeks to assign authorship to users classified as contributors. It looks like this wasn't fixed in 5.9.1, but I hope it's updated soon! Thanks.

[r-a-y]

I can confirm this bug.

The switch to use the 'capability' argument in wp_dropdown_users() broke the "Author" metabox for one of my custom post type plugins: ​https://github.com/WordPress/WordPress/commit/a225165010b5671a86f73401161bd1744f617c47#diff-175c8967d13579422e4261a53f12b70a90ca4cbdff289c9bbfcf0713770c8bf2L911

Because of the switch to check the CPT's 'edit_posts' cap, the user query checks the usermeta table to see if the capability exists: ​https://github.com/WordPress/WordPress/commit/a225165010b5671a86f73401161bd1744f617c47#diff-26773a0cc66b5ba7b3c5108652bb2367424e6a78d4a05d1e35ff6d45701e3c07R458

However, for plugins that dynamically set the CPT's capabilities for the user with the 'map_meta_cap' filter and do not manually add the cap to the usermeta DB table, the query would not return any users.

I have to workaround this by doing a variant of what @joneiseman mentioned in comment 11 for now.