[wp-trac] [WordPress Trac] #40922: Use finer-grained capabilities with `customize_changeset` post type

[WordPress Trac]

#40922: Use finer-grained capabilities with `customize_changeset` post type
-------------------------+------------------
 Reporter:  dlh          |       Owner:
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  4.9
Component:  Customize    |     Version:  4.7
 Severity:  normal       |  Resolution:
 Keywords:  has-patch    |     Focuses:
-------------------------+------------------

Comment (by westonruter):

 @dlh As we were just chatting about over Slack, perhaps what we can do is
 introduce a “meta meta cap” via the `map_meta_cap` filter. In core, we
 essentially need to map `edit_post` to `customize` and then `customize` to
 `edit_theme_options`. We could do this if the post type is registered with
 `edit_post` cap mapped to `customize` and then we have a `map_meta_cap`
 filter at a low priority that does:

 {{{#!php
 <?php
 add_filter( 'map_meta_cap', function( $caps, $cap ) {
         $post_type_object = get_post_type_object( 'customize_changeset' );
         if ( isset( $post_type_object->cap->$cap ) && false !== ( $i =
 array_search( 'customize', $caps ) ) ) {
                 $customize_caps = map_meta_cap( 'customize' ); // Get caps
 a plugin may require for Customizer.
                 array_splice( $caps, $i, 1, $customize_caps );
         }
         return $caps;
 }, 1, 2 );
 }}}

 Then plugins can further use `map_meta_cap` to map `edit_post` for a
 `customize_changeset` post to a separate discrete primitive cap like
 `edit_customize_changesets`.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/40922#comment:8>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform