0

This filter is letting manager users edit specific posts created by other users:

add_filter( 'user_has_cap', 'allow_manager', 10, 4 );
function allow_manager( $allcaps, $caps, $args, $user ) {

    // Bail out if we're not asking about a post:
    if ( 'edit_post' != $args[0] ) {
        return $allcaps;
    }
    // Bail out for users who can already edit others posts:
    if ( $allcaps['edit_others_posts'] ) {
        return $allcaps;
    }

    $userId = $args[1];
    $postId = $args[2];
    $post = get_post($postId);
    $authorId = $post->post_author;

    // Bail out if the user is the post author:
    if ( $userId == $authorId) {
        return $allcaps;
    }

    $managerId = get_user_meta( $authorId, 'MANAGER_ID', true );

    if ( $managerId == $userId ) {
        $allcaps[ "edit_others_posts" ] = true;
    }
    return $allcaps;
}

The manager can view the edit post screen for the other user's post, but when they select Publish/Update, the error returned is:

Sorry, you are not allowed to edit posts as this user. , derived from post.php.

Within class-wp-user.php, the function has_cap determines whether the user has the edit_others_posts cap. The user does have this cap from the above filter, but the $capabilities returned here in class-wp_user.php doesn't have the edit_others_posts:

$capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args, $this );

Is the native WP apply_filters overriding my add_filter? I'm not sure how to resolve.

/////

Edit: a similar issue was discussed ~7 years ago, but it's unclear if this was ever fixed: user_has_cap filter allows edit but will not allow save

1
  • I've done a temp workaround by commenting out the line in the filter: if ( 'edit_post' != $args[0] ) { return $allcaps; } which now works. Not ideal as it will add lots of overhead queries. This means the issue is beyond the edit_post capability...
    – alyx
    Nov 19 '21 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.