Elementor prompts non admin users to input HTTPAuth if page is behind HTTPAuth on post save

Setyl commented 2 years ago

[x] I've read and understood the contribution guidelines.
[x] I've searched for any related issues and avoided creating a duplicate issue.

Please give us a description of what happened.

If i'd save a post in Elementor with having the editor role, i get an HTTPAuth prompt because admin-ajax.php tries to send a 401 unauthorized, if the whole site is behind an HTTPAuth.

Please describe what you expected to happen and why.

I'd love to have no prompt at all.

The problem is in the file /wordpress-seo/src/integrations/third-party/elementor.php, line 241-243: if ( ! \current_user_can( 'manage_options' ) ) { \wp_send_json_error( 'Unauthorized', 401 ); } I'd suggest to use a Yoast capability instead, like 'wpseo_manage_options' as editors dont have 'manage_options'.

How can we reproduce this behavior?

Secure your site with HTTPAuth via .htaccess or similar
Login with editor role
Save a post in the Elementor editor

Technical info

If relevant, which editor is affected (or editors):
[x ] Elementor

Which browser is affected (or browsers):
[x] Chrome
[x] Firefox
[ ] Safari
[ ] Other

Used versions

WordPress version: 6.0
Yoast SEO version: 19.1
Elementor version: 3.6.6
Tested with theme: Twenty Twenty-Two 1.2

mmikhan commented 2 years ago

Thanks for bringing this to our attention. I investigated this and was able to reproduce it on our end. However, when I used the wpseo_manage_options as your recommendation in the following, it didn't fix the issue.

https://github.com/Yoast/wordpress-seo/blob/6742cd4a221098bf52e7929bf8c27f14cc3f4396/src/integrations/third-party/elementor.php#L241

So, there's probably something else going on that needs a deeper look. So, I marked it as a bug to ensure it gets attention to our development team.

Setyl commented 2 years ago

Thanks for reaching back. It's right, it won't fix the issue but one can change the editor capability in functions.php, to allow wpseo_manage_options then. Another option is to not send a 401 error. But i think to use the manage_options capability isn't best practice in any means.

mmikhan commented 2 years ago

Prioritized the issue internally: IM-1932

Yoast / wordpress-seo