Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: Hide Pages menu for users with insufficient roles #20287

Merged
merged 1 commit into from
Mar 13, 2023

Conversation

dvdchr
Copy link
Contributor

@dvdchr dvdchr commented Mar 9, 2023

Fixes #19885

This PR hides the Pages menu item from the Site Menu when the user has no edit_pages capability. As for XML-RPC access, we only check whether the user is an admin of the site (marked by the isAdmin boolean field). This matches how it's currently implemented in Android:

https://github.com/wordpress-mobile/WordPress-Android/blob/1dd182a56f1df4ba168c6750db866484370bf14c/WordPress/src/main/java/org/wordpress/android/ui/mysite/items/listitem/SiteListItemBuilder.kt#L119

Caveat: Editor accounts via XML-RPC will lose access to the Pages menu because 1.) editors aren't admins, and 2.) we currently do not pull any role information from the XML-RPC sync processes. Perhaps this is something to explore in the future.

To test

Follow the setup below, and verify the Pages menu visibility in My Sites > Menu.

Account type Role Pages menu
WordPress.com Admin 👁️ Visible
WordPress.com Editor 👁️ Visible
WordPress.com Author 🚫 Hidden
XML-RPC Admin 👁️ Visible
XML-RPC Editor 🚫 Hidden1
XML-RPC Author 🚫 Hidden

Regression Notes

  1. Potential unintended areas of impact
    See the caveat above about XML-RPC Editor roles.

  2. What I did to test those areas of impact (or what existing automated tests I relied on)
    Manually tested the changes.

  3. What automated tests I added (or what prevented me from doing so)
    N/A.

PR submission checklist:

  • I have completed the Regression Notes.
  • I have considered adding unit tests for my changes.
  • I have considered adding accessibility improvements for my changes.
  • I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.

Footnotes

  1. Note that this is a known issue. The current XML-RPC implementation only allows us to see if the user is an admin, but there's no information about the current user.

@dvdchr dvdchr added this to the 22.0 milestone Mar 9, 2023
@dvdchr dvdchr requested a review from wargcm March 9, 2023 10:52
@dvdchr dvdchr self-assigned this Mar 9, 2023
@wpmobilebot
Copy link
Contributor

You can test the changes in WordPress from this Pull Request by:
  • Clicking here or scanning the QR code below to access App Center
  • Then installing the build number pr20287-6c170b3 on your iPhone

If you need access to App Center, please ask a maintainer to add you.

@wpmobilebot
Copy link
Contributor

You can test the changes in Jetpack from this Pull Request by:
  • Clicking here or scanning the QR code below to access App Center
  • Then installing the build number pr20287-6c170b3 on your iPhone

If you need access to App Center, please ask a maintainer to add you.

Copy link
Contributor

@wargcm wargcm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM :shipit:

@dvdchr dvdchr merged commit cf7dfb0 into trunk Mar 13, 2023
@dvdchr dvdchr deleted the issue/19885-hide-pages-for-insufficient-roles branch March 13, 2023 08:28
@dvdchr
Copy link
Contributor Author

dvdchr commented Mar 13, 2023

Thanks @wargcm !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Roles lower than Editor should not be able to access Pages view
3 participants