Fix: Hide Pages menu for users with insufficient roles #20287
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #19885
This PR hides the Pages menu item from the Site Menu when the user has no
edit_pages
capability. As for XML-RPC access, we only check whether the user is an admin of the site (marked by theisAdmin
boolean field). This matches how it's currently implemented in Android:https://github.com/wordpress-mobile/WordPress-Android/blob/1dd182a56f1df4ba168c6750db866484370bf14c/WordPress/src/main/java/org/wordpress/android/ui/mysite/items/listitem/SiteListItemBuilder.kt#L119
Caveat: Editor accounts via XML-RPC will lose access to the Pages menu because 1.) editors aren't admins, and 2.) we currently do not pull any role information from the XML-RPC sync processes. Perhaps this is something to explore in the future.
To test
Follow the setup below, and verify the Pages menu visibility in My Sites > Menu.
Regression Notes
Potential unintended areas of impact
See the caveat above about XML-RPC Editor roles.
What I did to test those areas of impact (or what existing automated tests I relied on)
Manually tested the changes.
What automated tests I added (or what prevented me from doing so)
N/A.
PR submission checklist:
RELEASE-NOTES.txt
if necessary.Footnotes
Note that this is a known issue. The current XML-RPC implementation only allows us to see if the user is an admin, but there's no information about the current user. ↩