Skip to content

fix: do not remap core meta caps in access checks - #7627

Open
faisalahammad wants to merge 3 commits into
pods-framework:release/3.4.0from
faisalahammad:fix/7619-read-page-capability-warning
Open

fix: do not remap core meta caps in access checks#7627
faisalahammad wants to merge 3 commits into
pods-framework:release/3.4.0from
faisalahammad:fix/7619-read-page-capability-warning

Conversation

@faisalahammad

@faisalahammad faisalahammad commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

AI disclosure: this PR was written with GLM 5.3 flash assistance, reviewed and tested by me.

Description

Item-level access checks in pods_access_map_capabilities() were rewriting the canonical meta capabilities read_post, edit_post, and delete_post through the post type capability object before passing them to WP_User::has_cap(). For a pod with a page capability type, read_post becomes the literal string read_page. When that post type also has meta capability mapping disabled ("Full User Capabilities" unchecked), map_meta_cap() in WP 7.1 core reads the nonexistent $post_type->cap->read_page property and triggers a PHP warning for logged-out visitors.

The fix keeps those three meta caps canonical and lets core resolve them against the capability object itself, which it already does for every other path. I traced each capability flavor (post, page, custom) with mapping on and off: the outcomes are identical in every combination except the broken one, where the warning disappears.

Backward compatible: yes, no breaking changes.

Related GitHub issue(s)

Fixes #7619

Testing instructions

  1. Create a Custom Post Type extended by Pods with "Page" as the capability type and "Full User Capabilities" (meta capability mapping) disabled.
  2. Add a published item for that post type and log out of WordPress.
  3. With WP_DEBUG_DISPLAY enabled, visit the single item front-end view on WP 7.1.
  4. Before this PR: PHP Notice: Undefined property: stdClass::$read_page in wp-includes/capabilities.php appears.
  5. After this PR: no warning appears, and admin/author read access to the item still works as before.

Tested manually: confirmed this resolves the reported issue.

Screenshots / screencast

Not applicable, no UI changes.

Changelog text for these changes

Bug: Item-level access checks no longer rewrite read_post, edit_post, or delete_post through the post type capability object, which prevents a PHP warning from map_meta_cap when a post type with a page capability type has meta capability mapping disabled. #7619 (@sc0ttkclark)

PR checklist

sc0ttkclark and others added 3 commits September 1, 2026 12:14
Signed-off-by: Scott Kingsley Clark <lol@scottkclark.com>
Removed the Plugin ID from the header comments.

Signed-off-by: Scott Kingsley Clark <lol@scottkclark.com>
Keep read_post, edit_post, and delete_post canonical in
pods_access_map_capabilities so WordPress resolves them itself.
Prevents a PHP warning from map_meta_cap for post types using a page
capability type with meta capability mapping disabled.

Fixes pods-framework#7619
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants