I finally managed to update an old WP 3.3.1 site to WP 4.1 with few issues, but one unexpected change seems to have come about with relation to file uploads.
In the WP 3.3.1 version of the plugin, I enabled uploads for a custom Role via 'read' and 'upload_files'.
NOTE: This is for content that is NOT post driven. It's just the editor I want to grab things for some custom db tables. The wp_editor call has content explicitly set to ''. I'm using a buffering hack to reposition the editor, which is detailed at: https://wordpress.stackexchange.com/a/66345
// capture the editor for later use...
// HACK: https://wordpress.stackexchange.com/a/66345
ob_start();
wp_editor(
'',
'xyz-note-editor',
array(
'textarea_rows' => '10',
)
);
$editor = ob_get_clean();
// ...
$edit_form_template = str_replace('{{NotesEditor}}', $editor, $edit_form_template);
After the update to WP 4.1, everything works for Editors and Administrators.
It fails for Authors, Contributors and my custom role with the error: "You don't have permission to attach files to this post."
(The "post" appears to be an unrelated custom post type instance, which the uploaded media gets assigned to, when successfully uploading as an Editor or Administrator.)
Short of rebuilding things, or hunting down some plugin (like Members by Justin Tadlock, recommended elsewhere on StackExchange), I'm stuck.
Why can Editors circumvent upload restrictions in this case?
I've tried assigning edit/publish/read permissons for Editors (and below) to the custom Role with no success - based on http://codex.wordpress.org/Roles_and_Capabilities.
add_role(
XxYyConfig::USER_ROLE(),
'Custom Data Manager',
array(
'read' => true,
// ADDED: to address changes in how WordPress "Add Media" works - re: "You don't have permission to attach files to this post." error
// NOTE: Custom Data Managers, Contributors and Authors CANNOT add media -- BUT Editors/Administrators can. Trying to add to {custom_post_type} post (for reasons unknown). Content for editor set to ''...
'edit_files' => true,
'edit_others_pages' => true,
'edit_others_posts' => true,
'edit_pages' => true,
'edit_posts' => true,
'edit_private_pages' => true,
'edit_private_posts' => true,
'edit_published_pages' => true,
'edit_published_posts' => true,
'publish_pages' => true,
'publish_posts' => true,
'read_private_pages' => true,
'read_private_posts' => true,
// ADDED: END
'upload_files' => true,
)
);
I know I'm out in left field a bit here, but this feels inconsistent (even if something from ages long since gone has been "fixed").
map_meta_cap looks like it might apply here, but no custom post type makes me think that's the wrong solution.
Ideally, I'd like to know why the custom post type gets tagged during this whole thing, but I'm sticking to what permissions/capability handling needs to be set up to allow uploading through the WYSIWYG editor?
EDIT: Since my role is set up during plugin activation, I've been sure to deactivate and reactivate the plugin to ensure nothing unusual is happening there.