mcguffin / the-paste

Paste Images in WordPress from many applications and upload them to the media library.
https://wordpress.org/plugins/the-paste/
GNU General Public License v3.0
40 stars 11 forks source link

capabilities issue on multisite #38

Closed tomdevlive closed 1 year ago

tomdevlive commented 1 year ago

Getting this error:

Fatal error: Uncaught TypeError: Illegal offset type in isset or empty in /home/mysite/public_html/wp-includes/capabilities.php:801 Stack trace: #0 /home/mysite/public_html/wp-includes/class-wp-user.php(778): map_meta_cap(Object(WP_User), 1, 'edit_pages') #1 /home/mysite/public_html/wp-includes/capabilities.php(981): WP_User->has_cap(Object(WP_User), 'edit_pages') #2 /home/mysite/public_html/wp-includes/capabilities.php(873): user_can(Object(WP_User), Object(WP_User), 'edit_pages') #3 /home/mysite/public_html/wp-content/plugins/the-paste/include/ThePaste/Admin/User.php(59): current_user_can(Object(WP_User), 'edit_pages') #4 /home/mysite/public_html/wp-includes/class-wp-hook.php(308): ThePaste\Admin\User->personal_options(Object(WP_User)) #5 /home/mysite/public_html/wp-includes/class-wp-hook.php(332): WP_Hook->apply_filters('', Array) #6 /home/mysite/public_html/wp-includes/plugin.php(517): WP_Hook->do_action(Array) #7 /home/mysite/public_html/wp-admin/user-edit.php(394): do_action('personal_option...', Object(WP_User)) #8 /home/mysite/public_html/wp-admin/network/user-edit.php(13): require('/home/mysite/p...') #9 {main} thrown in /home/mysite/public_html/wp-includes/capabilities.php on line 801

To fix:

Locate this file - wp-content\plugins\the-paste\include\ThePaste\Admin\User.php

Replace this line: $can_edit = user_can( $profile_user, 'edit_posts' ) || current_user_can( $profile_user, 'edit_pages' );

With this line: $can_edit = user_can( $profile_user, 'edit_posts' ) || current_user_can( 'edit_pages' );

Reason for error: In the personal_options() method, you're passing a WP_User object to current_user_can(). It should instead be a string representing the capability you want to check.

Fix explained: In the revised line of code, I've replaced $profile_user with 'edit_pages' in the current_user_can() function. Now, the function is receiving the capability you're checking for as a string, which should eliminate the error.

awestuk commented 1 year ago

Hit this on a non-multisite, when other plugins were filtering the current_user_can capabilities and expecting a string. I've made a PR: https://github.com/mcguffin/the-paste/pull/41