Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#1493 - CreatePostMutation should not allow contributors to publish posts #1499

Conversation

jasonbahl
Copy link
Collaborator

What does this implement/fix? Explain your changes.

According to WordPress role definitions, Contributors can write and manage their own posts, but cannot publish them.

Currently, WPGraphQL allows contributors to publish posts.

This PR prevents users without publish_posts capability from publishing. If the mutation is set to publish, future or private, the status defaults to pending instead.

Does this close any currently open issues?

closes #1493

Any relevant logs, error output, GraphiQL screenshots, etc?

Mutation executed as a Contributor.

Screen Shot 2020-10-07 at 11 11 55 PM

@jasonbahl jasonbahl added type: bug Issue that causes incorrect or unexpected behavior scope: security Securing against vulnerabilities and threats impact: high Unblocks new use cases, substantial improvement to existing feature, fixes a major bug labels Oct 8, 2020
@jasonbahl jasonbahl self-assigned this Oct 8, 2020
@codecov
Copy link

codecov bot commented Oct 8, 2020

Codecov Report

Merging #1499 into develop will decrease coverage by 0.00%.
The diff coverage is 100.00%.

Impacted file tree graph

@@             Coverage Diff             @@
##           develop    #1499      +/-   ##
===========================================
- Coverage    59.04%   59.04%   -0.01%     
===========================================
  Files          192      192              
  Lines        11270    11309      +39     
===========================================
+ Hits          6654     6677      +23     
- Misses        4616     4632      +16     
Impacted Files Coverage Δ
src/Mutation/PostObjectCreate.php 62.85% <100.00%> (+0.42%) ⬆️
src/Admin/Settings/Settings.php 0.00% <0.00%> (ø)
src/Type/Object/PostObject.php 57.27% <0.00%> (+0.39%) ⬆️
access-functions.php 61.33% <0.00%> (+1.33%) ⬆️
src/Type/Object/TermObject.php 76.92% <0.00%> (+1.92%) ⬆️
src/Request.php 59.37% <0.00%> (+3.30%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d4f9fb5...839a8c6. Read the comment docs.

Copy link
Contributor

@duffn duffn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
impact: high Unblocks new use cases, substantial improvement to existing feature, fixes a major bug scope: security Securing against vulnerabilities and threats type: bug Issue that causes incorrect or unexpected behavior
Projects
None yet
Development

Successfully merging this pull request may close these issues.

createPost: Contributors can publish posts, should only be able to submit for review
2 participants