[wp-trac] [WordPress Trac] #37186: Media library shows post titles for posts the user can't read

[WordPress Trac]

#37186: Media library shows post titles for posts the user can't read
--------------------------+-----------------------------
 Reporter:  helen         |       Owner:  helen
     Type:  defect (bug)  |      Status:  closed
 Priority:  normal        |   Milestone:  4.6
Component:  Media         |     Version:
 Severity:  normal        |  Resolution:  fixed
 Keywords:  has-patch     |     Focuses:  administration
--------------------------+-----------------------------

Comment (by littler.chicken):

 I think this change needs to check if a `$parent_type` (line 478 in
 `class-wp-media-list-table.php`) returns a `null` value; eg if a post type
 is no longer registered (not usual, but it happens). Currently, if a post
 type is not registered and I visit the Media Library, or just use the
 Media Uploader, I get a notice along the lines of:

 {{{
 PHP Notice:  map_meta_cap was called <strong>incorrectly</strong>. The
 post type {no longer registered CPT} is not registered, so it may not be
 reliable to check the capability "read_post" against a post of that type.
 }}}

 Even if a post type is no longer registered, `$parent = get_post(
 $post->post_parent );` is returned as an object (line 471). Line 478,
 however, returns `null` for the parent post type:

 {{{
 $parent_type = get_post_type_object( $parent->post_type );
 }}}

 which then throws the notice for the `elseif` when WP checks if the
 current user can read the post of this post type.

 My guess is then that this function needs to add in a check for a `null`
 value of the parent post type, and deal with it accordingly, but I don't
 know how you would want that to show in the list. It does currently show
 the title of the no longer registered post type's post, which seems
 reasonable enough, and it's not linked, also reasonable, but I think it
 would be good to get rid of this notice. Changing the `elseif` conditional
 (line 484) to:

 {{{
 elseif ( null === $parent_type || current_user_can( 'read_post',
 $post->post_parent ) )
 }}}

 leaves the title intact, unlinked, without causing the notices, although I
 suppose it leaves the title visible for users without read privileges, so
 probably needs a little more something. In the `wp-includes/media.php`
 file, changing the conditional in line 3069 to:

 {{{
 if ( null !== $parent_type && current_user_can( 'read_post',
 $attachment->post_parent ) )
 }}}

 seems to address the issue for the media uploader, and I don't know that
 the parent title is displayed there, so that may be enough.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/37186#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform