Jet Engine: Users still able to approve revisions on CPT

publishpress / PublishPress-Revisions

Moderate, schedule and compare changes to published WordPress content.

https://publishpress.com/revisionary/

6 stars 9 forks source link

Closed rizaardiyanto1412 closed 6 months ago

rizaardiyanto1412 commented 10 months ago

ISSUE:

Users still being able to Approve Revisions even when they dont have edit_published capabilities for CPT from Jet Engine

So far this only happens for CPT coming from Jet Engine.

Works fine on default post type or cpt from CPT UI plugin.

bjoernzosel commented 9 months ago

workaround: block access in PP capabilities for .rvy-direct-approve

agapetry commented 6 months ago

@rizaardiyanto1412 @bjoernzosel I'm not able to replicate this issue using the current plugin releases. I tried with two different configurations:

JetEngine post type has a distinct capability type value defined in Post Type settings
JetEngine post type is defined without specifying a capability type, but is enabled for "Unique Post Type Capabilities" on the PublishPress Capabilities screen

In both cases, the Revisor cannot approve their own revision, even if they have the Post and Page capabilities you show.

rizaardiyanto1412 commented 6 months ago

@agapetry I confirm this is not an issue anymore in the latest plugin release. I think we could close this issue for now.