Make WordPress Core

Opened 20 months ago

Last modified 18 months ago

#54982 new defect (bug)

In 5.9 (classic) post editor the author pulldown only lists users with "edit_posts" capability

Reported by: joneiseman's profile joneiseman Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.9
Component: Editor Keywords: 2nd-opinion
Focuses: Cc:

Description

In WordPress 5.9 in the classic editor when editing a post, the “Author” pulldown only shows the administrators. In 5.8.3 it listed all of the authors (and contributors). Here’s the screenshot from 5.9 when using the classic editor: https://photos.app.goo.gl/zQjK441TmNKL2wJf9
It still shows all the authors (in 5.9) when I switch to the block editor. Here’s the screenshot using 5.9 with the block editor:
https://photos.app.goo.gl/ZAiT1gdDHT9F6RLF7

In 5.8.3 it lists all of the Authors in the Author dropdown when using the classic editor:
https://photos.app.goo.gl/qkyn4Bi3X3oDz3537

It looks like this was due to a change in the function post_author_meta_box in the file src/wp-admin/includes/meta-boxes.php
It used to display all of the authors and contributors regardless of their capabilities and now it only displays users that have the "edit_posts" capability.

Here's the commit that introduced the problem:
https://github.com/WordPress/wordpress-develop/commit/0cf6d3e48d18b4e8cb932fa02bb82bf5de14a48c

Change History (19)

#1 @joneiseman
20 months ago

  • Summary changed from In 5.9 (classic) post editor the author pulldown only lists users with "can_edit" capability to In 5.9 (classic) post editor the author pulldown only lists users with "edit_posts" capability

#2 @swissspidy
20 months ago

  • Milestone changed from Awaiting Review to 5.9.1
  • Severity changed from major to normal

#3 @pyrobd
20 months ago

Could not reproduce the issue, other user types like author, contributor also showing in the post edit dropdown, did I missed anything?

#4 @joneiseman
20 months ago

Hi @pyrobd
Are you using the classic editor plugin and editing with the classic editor?
See the following support forum posts to see other people that are running into the same problem: https://wordpress.org/support/topic/in-5-9-classic-post-editor-the-author-pulldown-only-lists-administrators-2/?view=all

#5 @pyrobd
20 months ago

Yes downloaded and activated the classic editor plugin, check this screenshot https://prnt.sc/26niyc9

#6 @joneiseman
20 months ago

Have you updated to WordPress 5.9? That's when the problem was introduced. Also, do those two users have the edit_posts capability?

#7 @pyrobd
20 months ago

Yes using WP 5.9 and users have default capability of the contributor role. @joneiseman

Last edited 20 months ago by pyrobd (previous) (diff)

#8 @joneiseman
20 months ago

Hi @pyrobd
I created a new WordPress install and I was able to confirm what you are seeing. It works correctly on the fresh install. If I go back to my existing site and disable all the plugins and switch to the default theme, I still see the problem. I will do some more investigation to figure out why it works on a fresh install and then I will comment here afterwards.

#9 @joneiseman
20 months ago

Hi @pyrobd,

I figured out why it works on the fresh install. If you create a new user with the Contributor or Author role those users will have the "edit_posts" capability. Existing Authors and Contributos on my site don't have the "edit_posts" capability. That's why it works on a fresh install but not on my existing site. There was apparently a change made to the default Capabilities for these roles You can install the User Role Editor plugin to remove the edit_posts capability for these two users to see the problem.

Last edited 20 months ago by joneiseman (previous) (diff)

#10 @joneiseman
20 months ago

The change to add the edit_posts capability to these roles was made in an earlier WordPress release (not in 5.9).

#11 @joneiseman
20 months ago

By default WordPress always gave Editors and Authors the "edit_posts" capability. I had removed this capability for those roles using the User Role Editor plugin (back in 2012). That's why I saw the problem in 5.9. Prior to 5.9 it selected the users based on the role and now it's based on the edit_posts capability. I can add a filter to work around the problem.

add_filter( 'wp_dropdown_users_args', 'my_dropdown_users_args', 10, 1 );
function my_dropdown_users_args( $query_args )
{
    $query_args['capability'] =  [];
    $query_args['roles__in'] = [ "Author", "Contributor", "Editor" ];
    return $query_args;
}

I think the administrator should be able to assign any user as the author even if that user doesn't have the edit_posts capability.

#12 @pyrobd
20 months ago

Understood the issue but still some might argue that users don't have editing permission should not be shown in the author I am not sure though.

#13 follow-up: @joneiseman
20 months ago

The process used on the website is that the Editor or Administrator creates the posts on behalf of the Contributors and then uses the pulldown to select the Author. The Contributors actually never log in, they just send in the post to the Editor or Administrator. There is no need to give the edit_posts capability to Contributors.

This ticket was mentioned in Slack in #core by audrasjb. View the logs.


20 months ago

#15 @audrasjb
20 months ago

  • Keywords 2nd-opinion added
  • Milestone changed from 5.9.1 to Awaiting Review

Hello,

As per today's bug scrub, let's move this ticket back to the Awaiting review queue to take the time to discuss whether this edge case should be reintroduced or not.

Thanks for your comprehension

#16 in reply to: ↑ 13 @pyrobd
20 months ago

Replying to joneiseman:

The process used on the website is that the Editor or Administrator creates the posts on behalf of the Contributors and then uses the pulldown to select the Author. The Contributors actually never log in, they just send in the post to the Editor or Administrator. There is no need to give the edit_posts capability to Contributors.

Got it now I also agree with you, so if the patch is needed now I will be happy to contribute my first Patch here.

#17 @jbilbro
19 months ago

I'm just chiming in here to reiterate that fixing this problem would be a big help. We have been relying on a workaround for the last couple weeks to assign authorship to users classified as contributors. It looks like this wasn't fixed in 5.9.1, but I hope it's updated soon! Thanks.

This ticket was mentioned in Slack in #forums by ipstenu. View the logs.


19 months ago

#19 @r-a-y
18 months ago

I can confirm this bug.

The switch to use the 'capability' argument in wp_dropdown_users() broke the "Author" metabox for one of my custom post type plugins: https://github.com/WordPress/WordPress/commit/a225165010b5671a86f73401161bd1744f617c47#diff-175c8967d13579422e4261a53f12b70a90ca4cbdff289c9bbfcf0713770c8bf2L911

Because of the switch to check the CPT's 'edit_posts' cap, the user query checks the usermeta table to see if the capability exists: https://github.com/WordPress/WordPress/commit/a225165010b5671a86f73401161bd1744f617c47#diff-26773a0cc66b5ba7b3c5108652bb2367424e6a78d4a05d1e35ff6d45701e3c07R458

However, for plugins that dynamically set the CPT's capabilities for the user with the 'map_meta_cap' filter and do not manually add the cap to the usermeta DB table, the query would not return any users.

I have to workaround this by doing a variant of what @joneiseman mentioned in comment 11 for now.

Last edited 18 months ago by r-a-y (previous) (diff)
Note: See TracTickets for help on using tickets.