'You need a higher level of permission' when editing categories through term.php

[jordesign]

Steps to reproduce the behavior

This takes place in certain sites - but can't be recreated in all sites. In most examples it is occurring on WPCOM Simple Sites.

1. Go to Posts > Categories (terms.php)
2. Click on a Category to edit it
3. Make a change and click 'Update'

What I expected to happen

Category term to be updated

What actually happened

• Page reloads with error message:

You need a higher level of permission

• JS Console shows a 403 error for the page.

Context

There are multiple reports of this behaviour on an old Trac ticket: 8092-wpcom

Does this happen on simple or atomic sites or both?

Best I can tell from other reports - it seems to be simple sites

Is there any console output or error text?

Failed to load resource: the server responded with a status of 403 ()

Level of impact (Does it block purchases? Does it affect more than just one site?)

Multiple reports over a long period - seems low impact.

Current workaround is to use the Calypso settings for categories (Settings > Writing)

Screenshot / Video: If applicable, add screenshots to help explain your problem.

Reported in #3865426-zen

[jordesign]

Listing other reports here for additional context:

• 8299800-hc
• 15875814-hc
• Blog RC 33712681
• 3578800-zd-woothemes
• 3676259-zd-woothemes
• 3843505-zd-woothemes
• https://wordpress.com/forums/topic/cant-edit-categories-need-higher-level-of-permission/ (Sep 2019)

[obenland]

I tried editing the Uncategorized category to adventure (one of the term IDs that I saw associated with the error in user interactions) and was able to reproduce it intermittently. I also received the error You attempted to edit an item that doesn’t exist. Perhaps it was deleted?.

When updating from Quick edit, the ajax handler just return -1 as an error response:

[Robertght]

Another case in 4153262-zen

[formosattic]

+1 4341252-zd-woothemes Happening in WordPress.com and WP Admin view.

[mrfoxtalbot]

I noticed the exact same error while trying to add an <img> tag to a term description. Could it be that users are running into this by trying to add raw HTML to their term description, @jordesign, @obenland?

As you described, this error only occurs if I try to add this <img> tag via wp-admin/edit-tags.php?taxonomy=category.

If I edit the term description via https://wordpress.com/settings/taxonomies/post_tag/ the img tag will be stripped but the plain text will be saved correctly and no error message is displayed.

[Robertght]

5355191-zen

[cometgrrl]

This happened to me tonight. I was able to reproduce it about 4 out 5 times.

It's very confusing, also hitting the back button, results in another error "You attempted to edit an item that does not exist. Perhaps it was deleted?"

[github-actions[bot]]

Support References

This comment is automatically generated. Please do not edit it.

• [ ] 3865426-zen
• [ ] 3578800-zen
• [ ] 3676259-zen
• [ ] 3843505-zen
• [ ] https://wordpress.com/forums/topic/cant-edit-categories-need-higher-level-of-permission
• [ ] 4153262-zen
• [ ] 4341252-zen
• [ ] 5355191-zen

[cometgrrl]

Also, I think it's term.php, not terms.php. At least it was for me.

"wp-admin/term.php?taxonomy=category&tag_ID=1&post_type=post&wp_http_referer=%2Fwp-admin%2Fedit-tags.php%3Ftaxonomy%3Dcategory"

[BogdanUngureanu]

I wasn't able to reproduce almost all scenarios, except the back button issue:

• Go to WP-admin > Posts > Tags
• Change the name of the tag
• Click update
• Click browser's back button
• You get a You attempted to edit an item that does not exist. Perhaps it was deleted?

After doing some debugging on Friday, this error happens on WPCOM Simple because we globalize the tags and categories. Meaning that the tag_IDs are shared globally between all sites.

For example, if you add a "testing" tag/category, you will notice that it has a small ID. If you change the name of the tag to "test", the tag ID will change - so internally it's not an update - that's not a Core multisite feature. When that happens, the browser back button will send you to a page that no longer exists (since the tag ID is not used on the site anymore).

The same thing happens for categories, however, for them we display the form correctly but when the user clicks on the update, the user will be presented with an error notice: Category not updated.

Possible solutions

• Let's try to fix the back button issue and close it as completed. If there are other reports for this, I think we should open a different issue for it (since the issue was first opened 3 years ago).
• I think we should override the core's behavior for these two pages. Instead of displaying an error page (Tags) or a form in an invalid state (Categories), we should redirect the users back to the main Tags/Categories pages. It's not ideal, I have to admit.

[BogdanUngureanu]

Opened D166089-code that fixes the back button problem.