Automattic / Co-Authors-Plus

Multiple bylines and Guest Authors for WordPress
https://wordpress.org/plugins/co-authors-plus/
GNU General Public License v2.0
287 stars 205 forks source link

Fix avatar collision on profile, post and edit screens #996

Open katag9k opened 10 months ago

katag9k commented 10 months ago

Description

Fixes filtering issues when a user has the same id as a guest-author post id on the post list screen, profile screen and the post edit takeover pop-up.

Related: #960 #973 #974

Steps to Test

Create a guest user that has the same post_id as another WP user_id.

In one browser, log in as the WordPress user and edit a post. In another browser login as the guest user. While logged in as a guest user, go to the post list at /wp-admin/edit.php the post will be locked as it's being edited by the WordPress user, however, the incorrect guest user's gravatar will be displayed.

Screenshot 2023-09-06 at 2 35 42 PM

Correct avatar should be:

Screenshot 2023-09-06 at 2 58 47 PM

Click edit on the post that is being edited, the warning popup will also have the incorrect gravatar from the guest user.

Screenshot 2023-09-06 at 2 37 52 PM

Correct avatar should be:

Screenshot 2023-09-06 at 1 22 37 PM

Take over the post editing. Go back to the browser where the Guest User was editing the post and wait for the "Somone else has taken over this post" pop-up. The incorrect avatar will be displayed:

Screenshot on 2023-09-15 at 14-10-16

The correct avatar should be:

Screenshot on 2023-09-15 at 14-05-54

Now log in as the WordPress user and go to the profile page at /wp-admin/profile.php the incorrect gravatar is displayed.

Screenshot 2023-09-06 at 2 40 37 PM

The correct avatar for the WordPress user:

Screenshot 2023-09-06 at 2 59 38 PM
BrookeDot commented 10 months ago

@katag9k, @GaryJones after some more testing it appears that this PR may be missing the condition when the post lock is removed via JS/Ajax. Adding the following appears to resolve it, but the two conditionals could likely be combined.

Thoughts?

// Do not filter the avatar if this is doing a heartbeat request on WP refresh lock
        if ( wp_doing_ajax() && isset( $_POST['action'] ) && $_POST['action'] === 'heartbeat' ) {
            return $args;
        }
GaryJones commented 10 months ago

@katag9k The merge conflict will need addressing please, as well as considering Brooke's comment.

katag9k commented 10 months ago

@BrookeDot Thank you, PR updated with the suggested code.

@GaryJones We are conflict free.