[wp-trac] [WordPress Trac] #50284: A fix to the CPT-no-create-when-submenu-child problem.

[WordPress Trac]

#50284: A fix to the CPT-no-create-when-submenu-child problem.
----------------------------+---------------------------------
 Reporter:  mort1305        |       Owner:  (none)
     Type:  defect (bug)    |      Status:  new
 Priority:  normal          |   Milestone:  Awaiting Review
Component:  Administration  |     Version:  5.5
 Severity:  normal          |  Resolution:
 Keywords:                  |     Focuses:  ui, administration
----------------------------+---------------------------------

Comment (by khag7):

 I can confirm that this bug exists.

 If a user does not have `edit_posts` capability but does have `edit_
 {custom-type}s` capability, they are prevented from accessing `wp-admin
 /post-new.php?post_type={custom-type}` if `edit.php?post_type={custom-
 type}` exists as a submenu item.

 For a "real world" example you can set up:
 - Install WooCommerce. They put the `shop_order` custom post type as a
 submenu item.
 - Create a custom role. I call mine 'Order Processor' which is someone who
 can create/edit orders but not other aspects of the website.
 - Give this person the capabilities relating to `shop_order` custom post
 types, but do not grant them `edit_posts` since we don't want them writing
 to our blog section. I do this in production, it used to work but I
 haven't tested it in a long time.

 My client tells me they did not have any issues with this person creating
 new orders until the 5.5 WordPress update, but I'm only partially
 confident that is true. It may have broken sooner. It may have been broken
 for quite a while. I'm not certain. I am certain it is broken now.

 The StackOverflow link in the ticket has a "fix" in the form of an action
 hook which does solve the problem for me. It works by hooking to
 `_admin_menu` and unsetting an array element from the global `$submenu`. I
 haven't tested the change proposed in this ticket.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/50284#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform