Automattic / Co-Authors-Plus

Multiple bylines and Guest Authors for WordPress
https://wordpress.org/plugins/co-authors-plus/
GNU General Public License v2.0
287 stars 205 forks source link

Fix ajax_suggest user and guest author id collision #974

Closed katag9k closed 11 months ago

katag9k commented 11 months ago

Description

Related to #960. When a WordPress user shares the same id as a guest-author post id, the CAP meta box will display the wrong avatar after searching for user or guest author.

Steps to Test

Ensure a guest author shares the same id (post_id) with a current WordPress user id.

katag9k commented 11 months ago

@GaryJones user_type distinction was added in the previous PR, it lives here: https://github.com/Automattic/Co-Authors-Plus/blob/45dbb837a8803b524fdbc207fb2538790aabae7c/co-authors-plus.php#L1858-L1860

When adding authors to a post but before saving the post, the incorrect avatar will show up for users that have the same ID as the guest author post type id.

Screenshot 2023-08-21 at 9 09 11 AM
GaryJones commented 11 months ago

@katag9k I'm still not seeing it.

Screenshot 2023-08-21 at 14 24 42

In my example, "gary" is a regular user, user_id = 7. I am logged into that account. It's my face showing as it picks up the gravatar from the user email address. It happens to also exist as a mapped guest author. ✅

The "A Guest Author" account is a guest author account, not linked to a regular user. The post_id = 7. The image matches the Set Avatar feature of editing the guest profile. ✅

When I remove the guest author avatar, then it correctly falls back to the Gravatar default image:

Screenshot 2023-08-21 at 14 23 38

If I remove the guest author mapping for "gary" (so it is only a regular user), then the behaviour is the same.

I'm going to need more hand-holding to replicate this please.

GaryJones commented 11 months ago

Since I was logged in as the duplicitous user, the new post I was creating already had me assigned as the author (see gary in the screenshots above).

When I added a random author (Minnie), so I could then remove gary, and then start to add gary and get the Ajax result, I could see the wrong URL being delivered.

Before - the San Francisco URL is for "A Guest Author" (post_id=7):

Screenshot 2023-08-25 at 15 54 20

After applying this PR - the Gravatar URL is the correct one for gary (user_id = 7).

Screenshot 2023-08-25 at 15 55 04