Custom post type to store logs uses default capability type

[benoitchantre]

What WordPress, PHP and Simple SMTP versions are you using?
Simple SMTP 1.2.3

Describe the bug
The custom post type to store logs uses default capability type with no additional capabilities.

Expected behavior
The capability required to view/delete logs should be related to an admin role, for example manage_options.

[soup-bowl]

Good catch on the lazy implementation there. Ironically comes at a time where in a private repo I'm a member of, someone has complained about developers using misguided cap types impacting custom role assignments.

[benoitchantre]

#75 is not directly related to this issue.

When the sbss_email_log post type is registered, the default capabilities (post) are used instead of a capability specific to an adminstrator role.

wp-simple-smtp/src/log/class-logservice.php

Lines 38 to 40 in f657d94

	public function register_log_storage() {
	register_post_type( $this->post_type );
	}

There shoud be an additional capabilities argument passed to this function to be safer.

For example:

'capabilities'        => array(
	'publish_posts'       => 'manage_options',
	'edit_others_posts'   => 'manage_options',
	'delete_posts'        => 'manage_options',
	'delete_others_posts' => 'manage_options',
	'read_private_posts'  => 'manage_options',
	'edit_post'           => 'manage_options',
	'delete_post'         => 'manage_options',
	'read_post'           => 'manage_options',
),

[soup-bowl]

Okay, thanks for clarifying.