WPIntell

Source evidence

Editors lost access

Attributes for Blocks · support · 2024-10-18T12:26:00+00:00

complaintsentiment
highseverity
1.0relevance
7replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 35 rows with source links

14.3% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

30 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
stphnwlkr unresolved
We have been using this for over a year and in one of the recent updates our editors lost access to the tool. Admins have no issues, but they are not normally responsible for the content. Is this a known issue? Is there a way to troubleshoot it to see why. This is in a multisite environment running current versions of everything. It was part of a security fix to prevent users without unfiltered_html capability from adding attributes as it can be used maliciously. If you trust your editor users then you can grant them the capability. You can give the capability to roles: add_action('init', function() { if($role = get_role('contributor')) { $role->add_cap('unfiltered_html'); } }); Or to individual users: add_action('init', function() { if($user = get_user_by('login', 'editor-users-login')) { if(!$user->has_cap('unfiltered_html')) { $user->add_cap('unfiltered_html'); } } }); There are probably plugins that allow managing the capabilities without code as well. I tried the code, and I tried adding the unfiltered_html capability to Capabilities Pro, and neither seems to work. Capabilities Pro states it is an unrecognized capability. Here’s another method to do it, by filtering the capabilities, rather than granting them: add_filter('user_has_cap', function($allcaps, $caps, $args, $user) { if( in_array('unfiltered_html', $caps, true) && in_array('editor', $user->roles, true) ) { $allcaps['unfiltered_html'] = true; } return $allcaps; }, 10, 4); This one should allow unfiltered_html for every user with editor role. Still not working in my hosting environment (WordPress VIP). I am also checking with them to see if there is a conflict. So, it turns out in multisite that current_user_can will not work on this capability because it is disabled even for admins. Only super admins have access. The team thinks there might be a flaw in Core that needs to be resolved and are researching. The code we used was: function multisite_allow_unfiltered_html_per_role( $caps, $cap, $user_id, $args ) { if ( ‘unfiltered_html’ === $cap ) { $user = get_userdata( $user_id ); $roles = $user->roles; foreach ( $roles as $role ) { $role = get_role( $role ); if ( $role->has_cap( ‘unfiltered_html’ ) ) { return $caps = array( ‘unfiltered_html’ ); } } } return $caps; } add_filter( ‘map_meta_cap’, ‘multisite_allow_unfiltered_html_per_role’, 1, 4 ); This makes it an available capability and we use Capabilities Pro to enable it. Ah, interesting. And just to confirm, when you said earlier: Admins have no issues, but they are not normally responsible for the content. did you mean super admins? Cause if it was regular admins and they weren’t supposed to have unfiltered_html capability but were able to add attributes it might be something I need to look into as well. It just so happens that everybody who has been able to use it has super admin rights. I made an assumption that it was because we were admins.

Comments

7 shown
websevendev 2024-10-18T13:01:00+00:00

It was part of a security fix to prevent users without unfiltered_html capability from adding attributes as it can be used maliciously. If you trust your editor users then you can grant them the capability. You can give the capability to roles: add_action('init', function() { if($role = get_role('contributor')) { $role->add_cap('unfiltered_html'); } }); Or to individual users: add_action('init', function() { if($user = get_user_by('login', 'editor-users-login')) { if(!$user->has_cap('unfiltered_html')) { $user->add_cap('unfiltered_html'); } } }); There are probably plugins that allow managing the capabilities without code as well.

stphnwlkr 2024-10-18T13:41:00+00:00

I tried the code, and I tried adding the unfiltered_html capability to Capabilities Pro, and neither seems to work. Capabilities Pro states it is an unrecognized capability.

websevendev 2024-10-18T13:59:00+00:00

Here’s another method to do it, by filtering the capabilities, rather than granting them: add_filter('user_has_cap', function($allcaps, $caps, $args, $user) { if( in_array('unfiltered_html', $caps, true) && in_array('editor', $user->roles, true) ) { $allcaps['unfiltered_html'] = true; } return $allcaps; }, 10, 4); This one should allow unfiltered_html for every user with editor role.

stphnwlkr 2024-10-18T14:09:00+00:00

Still not working in my hosting environment (WordPress VIP). I am also checking with them to see if there is a conflict.

stphnwlkr 2024-10-18T17:47:00+00:00

So, it turns out in multisite that current_user_can will not work on this capability because it is disabled even for admins. Only super admins have access. The team thinks there might be a flaw in Core that needs to be resolved and are researching. The code we used was: function multisite_allow_unfiltered_html_per_role( $caps, $cap, $user_id, $args ) { if ( ‘unfiltered_html’ === $cap ) { $user = get_userdata( $user_id ); $roles = $user->roles; foreach ( $roles as $role ) { $role = get_role( $role ); if ( $role->has_cap( ‘unfiltered_html’ ) ) { return $caps = array( ‘unfiltered_html’ ); } } } return $caps; } add_filter( ‘map_meta_cap’, ‘multisite_allow_unfiltered_html_per_role’, 1, 4 ); This makes it an available capability and we use Capabilities Pro to enable it.

websevendev 2024-10-18T18:59:00+00:00

Ah, interesting. And just to confirm, when you said earlier: Admins have no issues, but they are not normally responsible for the content. did you mean super admins? Cause if it was regular admins and they weren’t supposed to have unfiltered_html capability but were able to add attributes it might be something I need to look into as well.

stphnwlkr 2024-10-18T19:08:00+00:00

It just so happens that everybody who has been able to use it has super admin rights. I made an assumption that it was because we were admins.