search

chesio / bc-cache

Simple full page cache plugin for WordPress inspired by Cachify
The Unlicense
9 stars 0 forks source link

Cache Viewer page is accessible only to users with manage_options capability (unfiltered) #110

Closed chesio closed 6 months ago

chesio commented 6 months ago

However link to the page in dashboard widget is rendered whenever this call returns true:

apply_filters(Hooks::FILTER_USER_CAN_FLUSH_CACHE, current_user_can('manage_options'))

Let's tackle it as part of 3.4, it might be not straight-forward to fix.

chesio commented 6 months ago

Let's tackle it as part of 3.4, it might be not straight-forward to fix.

It's actually straight-forward to fix. Only users with manage_options capability can access Cache Viewer, this has always been the case and it is documented this way as well. However, any user can flush the cache in case corresponding filter is set accordingly. So the issue is only about display of link to Cache Viewer in dashboard: if user can flush the cache, but does not have manage_options capability, there should be no link (only plain text).