Private Reusable Blocks are Never Visible

[mrwweb]

Description

Reusable blocks can be marked as "Private". Doing this prevents the block from appearing on the front end, even to logged in visitors or when placed on a Private page.

1. Create a block.
2. Make it a reusable block.
3. Edit the block via the "Manage reusable blocks" interface and set it to private

The block correctly appears in the editor but is missing on the front end.

Expected behaviour

I would expect Private blocks to behave like private pages. Hidden from logged-out visitors and visible to logged-in visitors.

Actual behaviour

Private reusable blocks do not appear on the front end under any circumstances.

Screenshots or screen recording (optional)

Editing the Reusable Block from the "Manage Reusable blocks" screen

The editor screen showing the reusable block

A logged in viewer does not see the reusable block

WordPress information

• WordPress version: 5.6
• Gutenberg version: 9.8.2
• Are all plugins except Gutenberg deactivated? Yes
• Are you using a default theme (e.g. Twenty Twenty-One)? Yes

[noisysocks]

I would expect Private blocks to behave like private pages. Hidden from logged-out visitors and visible to logged-in visitors.

Would you expect that it's visible to any logged in visitor?

[mrwweb]

@noisysocks I think so, but I don't remember the precise behavior of Private posts. This is still my literal expected behavior: I would expect Private blocks to behave like private pages" (in terms of when they are and aren't visible).

[gotoseaboy]

@mrwweb @noisysocks I am brand new to WordPress but have run into this. Private posts seem to be visible only to the logged in author of those posts, so would be great if private reusable blocks could also be selectable for their logged in author.

My goal is to allow each user to manage and easily find their own blocks and not be overwhelmed by everyone else's in the editor.

[noisysocks]

My goal is to allow each user to manage and easily find their own blocks and not be overwhelmed by everyone else's in the editor.

That makes sense and is a really good use-case. What should happen though if User A inserts one of their private reusable blocks into a public post and then User B edits that post? Would they see the reusable block? And what about on the frontend? If a logged out visitor visits a public post with a private reusable block in it, would they see the block?

It might be helpful to draw up a table of all of these combinations so that we are sure we're doing something sensible in all of the different edge cases.

[gotoseaboy]

Hi Robert, thank you for the reply.

I'm not sure about correct development practice but what I have observed is, right now a Contributor can insert another user's public block and if they don't have the edit_others_posts capability it displays as a constantly-loading object with hourglass. So maybe it could behave the same when User B goes to edit a post with User A's private block inside. Once I knew about the roles and capabilities, I could accept this situation, but I suppose there could be a nicer message possibly saying this block belongs to another user or is private.

On the front end, all I can think is that block could just be removed as if it just isn't there. Just like if you try to access a private post or list all the posts while unauthenticated, that post basically isn't there.

Thanks, Will