Fix user capabilities check for the Site Editor #61444
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
t-hamano
added
[Type] Bug
t-hamano
changed the title
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
|
Size Change: -7 B (0%) Total Size: 1.74 MB
ℹ️ View Unchanged
|
Mamaduka
approved these changes
May 7, 2024
youknowriad
reviewed
May 7, 2024
packages/core-commands/src/hooks.js
Outdated
| @@ -6,7 +6,7 @@ import { useSelect } from '@wordpress/data'; | |||
|
|
|||
| export function useIsTemplatesAccessible() { | |||
| return useSelect( | |||
| ( select ) => select( coreStore ).canUser( 'read', 'templates' ), | |||
| ( select ) => select( coreStore ).canUser( 'create', 'templates' ), | |||
There was a problem hiding this comment.
The name of the hook is not congruent with what it does. I understand that it's an internal hook so it's not that important but maybe the hook should be renamed?
There was a problem hiding this comment.
Indeed. For example, is useCanCreateTemplates appropriate?
There was a problem hiding this comment.
Works for me or even remove the hook entirely. Not sure how useful is it to abstract it.
There was a problem hiding this comment.
remove the hook entirely
That makes sense. I would like to merge this PR after removing this hook and switching to an ad hoc approach.
This was referenced May 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #61419
What?
This PR correctly checks for non-admin user capabilities for commands and link buttons related to the site editor. This fixes an issue where unintended commands and links are displayed for non-admin users.
Why?
Previously, determining whether the site editor was accessible depended on having permission to "read" templates. However, my understanding is that in #60326, permission to read templates was added for users with
edit_postpermissions.This exposes commands and links that users cannot access even though they do not have
edit_theme_optionspermission.How?
Related commands and links now check for "create" permission instead of "read" permission. This should now correctly determine whether users have the
edit_theme_optionspermission as before.Testing Instructions
Open the post editor as an admin user and as an editor user and test the following.
Admin
Command
Link button
All links below link to the Site Editor's Patterns page.
Editor
Command
edit.php?post_type=wp_block.Link button
All links below link to
edit.php?post_type=wp_block.Note
While creating this PR, I also noticed that individual pages, individual templates, and individual template parts were exposed to non-admin users via the command palette. These are caused by the fact that there is no permission check in the first place, so I would like to fix it in a follow-up PR.