[wp-trac] [WordPress Trac] #53972: Improper capability check when viewing attachment of private custom post type

[WordPress Trac]

#53972: Improper capability check when viewing attachment of private custom post
type
--------------------------+-----------------------------
 Reporter:  sccr410       |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Users         |    Version:  5.8
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 WP 5.8

 Create custom post type:
 * Created a unique custom post type (e.g. "sample") with custom
 capability_type (e.g. "sample")
 * Create a new post under this post type, set to private
 * Upload attachment as featured image (so it's parent is set to the custom
 post type post)

 Set capabilities:
 * Customize subscriber role capabilities to allow "read_private_samples"

 Create user:
 * Create new Subscriber user
 * View the attachment URL

 EXPECTED: User to be able to view this URL
 ACTUAL: User cannot view the URL, 404 page

 From what I can tell, it is checking for the existence of the
 "read_private_posts" capability for the currently logged in user when it
 should be checking for the "read_private_samples" capability.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53972>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform