[WordPress] capacité edit_published_pages trop permissive ?

Bonjour,

Je souhaite donner aux auteurs du blog sur lequel je travaille la possibilité de créer, éditer, publier, modifier leurs propres pages. Pour cela, j'ai ajouté ce bout de code dans mon functions.php :

function add_my_author_role_caps(){
  global $pagenow;

  // gets the author role
  $role = get_role( 'author' );

  if ( 'themes.php' == $pagenow && isset( $_GET['activated'] ) ){ // Test if theme is activated
    // Theme is activated

    // This only works, because it accesses the class instance.
    $role->add_cap( 'edit_pages' );
    $role->add_cap( 'publish_pages' );
    $role->add_cap( 'edit_published_pages' );
  }
  else {
    // Theme is deactivated
    // Remove the capacity when theme is deactivated
    $role->remove_cap( 'edit_pages' );
    $role->remove_cap( 'publish_pages' ); 
    $role->remove_cap( 'edit_published_pages' );
  }
}
add_action( 'load-themes.php', 'add_my_author_role_caps' );

J'ai trouvé cet exemple ici : https://codex.wordpress.org/Function_Reference/add_cap
J'ai vérifié, les nouvelles capacités sont bien ajoutées au rôle author. J'ai regardé dans la base de données, dans la table wp_options, dans la colonne option_name la valeur de wp_user_roles (colonne option_value).
L'auteur peut effectivement créer des pages les publier et les modifier. Ce qui est plus bizarre, c'est qu'il peut également modifier les pages des autres, or je n'ai pas ajouté la cap edit_others_pages. Pour avoir un aperçu de toutes les capacités aller ici : https://codex.wordpress.org/Roles_and_Capabilities#Capability_vs._Role_Table
J'ai tenté de retirer la capacité edit_published_pages, mais dans ce cas, l'auteur ne peut pas modifier ses propres pages...
Bogue de Wordpress ou mécompréhension ?

Merci d'avance.

Pour être complet, voici la valeur de wp_user_roles :

a: 5: {
    s: 13: "administrator";a: 2: {
        s: 4: "name";s: 13: "Administrator";s: 12: "capabilities";a: 61: {
            s: 13: "switch_themes";b: 1;s: 11: "edit_themes";b: 1;s: 16: "activate_plugins";b: 1;s: 12: "edit_plugins";b: 1;s: 10: "edit_users";b: 1;s: 10: "edit_files";b: 1;s: 14: "manage_options";b: 1;s: 17: "moderate_comments";b: 1;s: 17: "manage_categories";b: 1;s: 12: "manage_links";b: 1;s: 12: "upload_files";b: 1;s: 6: "import";b: 1;s: 15: "unfiltered_html";b: 1;s: 10: "edit_posts";b: 1;s: 17: "edit_others_posts";b: 1;s: 20: "edit_published_posts";b: 1;s: 13: "publish_posts";b: 1;s: 10: "edit_pages";b: 1;s: 4: "read";b: 1;s: 8: "level_10";b: 1;s: 7: "level_9";b: 1;s: 7: "level_8";b: 1;s: 7: "level_7";b: 1;s: 7: "level_6";b: 1;s: 7: "level_5";b: 1;s: 7: "level_4";b: 1;s: 7: "level_3";b: 1;s: 7: "level_2";b: 1;s: 7: "level_1";b: 1;s: 7: "level_0";b: 1;s: 17: "edit_others_pages";b: 1;s: 20: "edit_published_pages";b: 1;s: 13: "publish_pages";b: 1;s: 12: "delete_pages";b: 1;s: 19: "delete_others_pages";b: 1;s: 22: "delete_published_pages";b: 1;s: 12: "delete_posts";b: 1;s: 19: "delete_others_posts";b: 1;s: 22: "delete_published_posts";b: 1;s: 20: "delete_private_posts";b: 1;s: 18: "edit_private_posts";b: 1;s: 18: "read_private_posts";b: 1;s: 20: "delete_private_pages";b: 1;s: 18: "edit_private_pages";b: 1;s: 18: "read_private_pages";b: 1;s: 12: "delete_users";b: 1;s: 12: "create_users";b: 1;s: 17: "unfiltered_upload";b: 1;s: 14: "edit_dashboard";b: 1;s: 14: "update_plugins";b: 1;s: 14: "delete_plugins";b: 1;s: 15: "install_plugins";b: 1;s: 13: "update_themes";b: 1;s: 14: "install_themes";b: 1;s: 11: "update_core";b: 1;s: 10: "list_users";b: 1;s: 12: "remove_users";b: 1;s: 13: "promote_users";b: 1;s: 18: "edit_theme_options";b: 1;s: 13: "delete_themes";b: 1;s: 6: "export";b: 1;
        }
    }
    s: 6: "editor";a: 2: {
        s: 4: "name";s: 6: "Editor";s: 12: "capabilities";a: 34: {
            s: 17: "moderate_comments";b: 1;s: 17: "manage_categories";b: 1;s: 12: "manage_links";b: 1;s: 12: "upload_files";b: 1;s: 15: "unfiltered_html";b: 1;s: 10: "edit_posts";b: 1;s: 17: "edit_others_posts";b: 1;s: 20: "edit_published_posts";b: 1;s: 13: "publish_posts";b: 1;s: 10: "edit_pages";b: 1;s: 4: "read";b: 1;s: 7: "level_7";b: 1;s: 7: "level_6";b: 1;s: 7: "level_5";b: 1;s: 7: "level_4";b: 1;s: 7: "level_3";b: 1;s: 7: "level_2";b: 1;s: 7: "level_1";b: 1;s: 7: "level_0";b: 1;s: 17: "edit_others_pages";b: 1;s: 20: "edit_published_pages";b: 1;s: 13: "publish_pages";b: 1;s: 12: "delete_pages";b: 1;s: 19: "delete_others_pages";b: 1;s: 22: "delete_published_pages";b: 1;s: 12: "delete_posts";b: 1;s: 19: "delete_others_posts";b: 1;s: 22: "delete_published_posts";b: 1;s: 20: "delete_private_posts";b: 1;s: 18: "edit_private_posts";b: 1;s: 18: "read_private_posts";b: 1;s: 20: "delete_private_pages";b: 1;s: 18: "edit_private_pages";b: 1;s: 18: "read_private_pages";b: 1;
        }
    }
    s: 6: "author";a: 2: {
        s: 4: "name";s: 6: "Author";s: 12: "capabilities";a: 13: {
            s: 12: "upload_files";b: 1;s: 10: "edit_posts";b: 1;s: 20: "edit_published_posts";b: 1;s: 13: "publish_posts";b: 1;s: 4: "read";b: 1;s: 7: "level_2";b: 1;s: 7: "level_1";b: 1;s: 7: "level_0";b: 1;s: 12: "delete_posts";b: 1;s: 22: "delete_published_posts";b: 1;s: 10: "edit_pages";b: 1;s: 13: "publish_pages";b: 1;s: 20: "edit_published_pages";b: 1;
        }
    }
    s: 11: "contributor";a: 2: {
        s: 4: "name";s: 11: "Contributor";s: 12: "capabilities";a: 5: {
            s: 10: "edit_posts";b: 1;s: 4: "read";b: 1;s: 7: "level_1";b: 1;s: 7: "level_0";b: 1;s: 12: "delete_posts";b: 1;
        }
    }
    s: 10: "subscriber";a: 2: {
        s: 4: "name";s: 10: "Subscriber";s: 12: "capabilities";a: 2: {
            s: 4: "read";b: 1;s: 7: "level_0";b: 1;
        }
    }
}

Modifié par jojaba (02 Oct 2016 - 17:34)

Bonjour, avec un peu de retard...

Je pense que edit_published_pages est une capacité liée à TOUTES les pages publiées, et non seulement à celles liées à l'utilisateur courant.

Pour contourner ce problème je créé des restrictions d'accès selon un groupe d'appartenance (fonction qui n'est pas native dans WordPress mais que j'ai ajouté). Le groupe est définit dans les meta box de l'article et aussi dans les metas de l'utilisateur.