Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't show "Move to Trash" link if current user cannot delete posts #23144

Closed
ocean90 opened this issue Jun 14, 2020 · 2 comments · Fixed by #23174
Closed

Don't show "Move to Trash" link if current user cannot delete posts #23144

ocean90 opened this issue Jun 14, 2020 · 2 comments · Fixed by #23174
Assignees
Labels
[Package] Editor /packages/editor [Status] In Progress Tracking issues with work in progress [Type] Bug An existing feature does not function as intended

Comments

@ocean90
Copy link
Member

ocean90 commented Jun 14, 2020

Describe the bug
Noticed this while working on #23119. The current component has no checks for current user's capabilities. But there are three that need to be checked: delete_posts, delete_others_posts, and delete_published_posts.

To reproduce

  • Create a user with only read and edit_posts capabilities
  • Create a new post and click the trash link.
  • You'll get the "Sorry, you are not allowed to delete this post." error notice.

Expected behavior
If the user has no access to delete posts the link should not be displayed.

Screenshots
If applicable, add screenshots to help explain your problem.
image

Additional context
This probably needs a patch for core to extend the checks in WP_REST_Posts_Controller::get_available_actions() too.

@ocean90 ocean90 added [Type] Bug An existing feature does not function as intended [Package] Editor /packages/editor labels Jun 14, 2020
@ocean90
Copy link
Member Author

ocean90 commented Jun 14, 2020

Ticket for adding an action-delete action: https://core.trac.wordpress.org/ticket/50388

@ocean90
Copy link
Member Author

ocean90 commented Jun 14, 2020

On a second thought, we might be able to use the existing select( 'core' ).canUser() for the check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[Package] Editor /packages/editor [Status] In Progress Tracking issues with work in progress [Type] Bug An existing feature does not function as intended
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant