Fix taxonomy capabilities #7613

renatho · 2024-06-06T19:03:20Z

Proposed Changes

We received a report of Contributors (WordPress role) being able to access some taxonomy edit screens (/wp-admin/term.php?taxonomy=module&tag_ID=ID&post_type=course) directly through the edit URL, but not being able to save it.
- The same applies for module, course-category, lesson-tag, and question-category.
In order to correct this behavior, updated the taxonomy capabilities and updated the roles to work properly. Notice that the only roles that have the manage_categories capability by default are admin and editor.. So adding the new roles to administrator, editor, and teacher looks a good solution to me.

Alternative approach

See #7613 (comment)

Context

The previous changes for the module taxonomy happened in this PR: #459

The first commit has the following description (the best context I could extract from the history):

give teacher access to modules on the edit course screen

Known issues

Teacher can't add tags to lessons and categories to courses #7612

Testing Instructions

Bump the version on SENSEI_LMS_VERSION, so the new capabilities are properly created.
Create a module as admin.
Edit the module and copy the URL of the editor.
Try to access as a user with the role contributor, and make sure they don't have access to it anymore.

Now let's make sure everything continues working properly:

As a teacher, create a course.
Add some modules with lessons.
Save the course, and make sure the modules were properly created.
Add a new course category in the editor sidebar.
Refresh the editor.
It should create the new category, but don't assign it because of the known issue (Teacher can't add tags to lessons and categories to courses #7612).
Add lessons.
Open the lesson editor.
Add a new lesson tag in the editor sidebar.
Refresh the editor.
It should create the new tag, but don't assign it because of the known issue (Teacher can't add tags to lessons and categories to courses #7612).
Create a question.
Add a category in the sidebar.
Publish the question, and make sure the category was properly created.
Create a new course, and remove all blocks to have a legacy course.
Add a new module (sidebar).
Create a lesson (meta boxes in the bottom of the editor).
Add the module to a lesson and make sure it works properly.
Repeat the tests with an admin and make sure it continues working properly.

Pre-Merge Checklist

github-actions · 2024-06-06T19:10:51Z

Test the previous changes of this PR with WordPress Playground.

github-actions · 2024-06-06T19:42:02Z

Test the previous changes of this PR with WordPress Playground.

github-actions · 2024-06-06T20:21:52Z

Test the previous changes of this PR with WordPress Playground.

renatho · 2024-06-06T20:22:20Z

includes/class-sensei.php

@@ -1844,6 +1844,10 @@ public function add_editor_caps() {

 		if ( ! is_null( $role ) ) {
 			$role->add_cap( 'manage_sensei_grades' );
+
+			$role->add_cap( 'manage_lesson_categories' );


Admin and editor weren't receiving these capabilities previously. I think we didn't notice it before because we weren't explicitly using it, so it didn't cause any issue.

renatho · 2024-06-06T20:23:27Z

includes/class-sensei-teacher.php

@@ -204,6 +204,7 @@ protected function add_capabilities() {

 				// Questions
 				'publish_questions'              => true,
+				'manage_question_categories'     => true,


We were already adding it for courses and lessons, but not for questions.

renatho · 2024-06-06T20:24:03Z

includes/class-sensei-updates.php

+	 *
+	 * @since 4.24.1
+	 */
+	private function v4_24_1_update_capabilities() {


Since we changed capabilities, we need a migration to apply the changes. It only happens on the plugin activation.

github-actions · 2024-06-06T21:03:47Z

Test the previous changes of this PR with WordPress Playground.

github-actions · 2024-06-06T21:06:01Z

Test the previous changes of this PR with WordPress Playground.

renatho · 2024-06-06T21:07:22Z

includes/class-sensei-modules.php

@@ -2180,9 +2180,9 @@ public function setup_modules_taxonomy() {
 			'hierarchical'       => true,
 			'show_admin_column'  => false,
 			'capabilities'       => array(


My first try was to just remove the capabilities to use the default ones. It would use just use the manage_categories for edit_terms.

But since teachers don't have the capability manage_categories, it was hiding the buttons to add the categories through the editor sidebar.

github-actions · 2024-06-06T21:20:11Z

Test the previous changes of this PR with WordPress Playground.

renatho · 2024-06-07T13:28:22Z

I started it without a changelog entry because users probably won't notice that, but thinking more I decided to add an entry (bbc71c7), in case someone has special customizations with roles and capabilities.

github-actions · 2024-06-07T13:32:29Z

Test the previous changes of this PR with WordPress Playground.

merkushin

Looks good and works well 👍

I had three observations during the tests.

1. It is related to the test instructions.

It looks like I cannot follow the instruction not to assign the tag:

2. Course Outline in the lesson preview for teacher

I previewed the draft lesson as a teacher and found the course outline was empty. Checked in Safari and Chrome in case it was an issue with styles: same result.
And then tested with an admin account: everything is in its place.

3. Assign module in the lesson for a legacy course

I found that when I first open the lesson in the editor I can't assign the module. It says set the course first, even though it the course is set. But it works fine after saving the draft and refreshing.

renatho · 2024-06-11T18:08:11Z

Thank you for the review, @merkushin!

It looks like I cannot follow the instruction not to assign the tag

Do you mean you couldn't reproduce the known issue and after the refresh, the lesson tag persisted for you?

And then tested with an admin account: everything is in its place.

I think it's an expected behavior because of this:

sensei/includes/class-sensei-course-structure.php

Line 81 in 179f7e5

    
           $published_lessons_only = 'view' === $context && ! current_user_can( 'read_private_posts' );

But I agree that it could be better, offering the same behavior to teachers. Do you think it's worth an enhancement issue for it?

I found that when I first open the lesson in the editor I can't assign the module. It says set the course first, even though it the course is set. But it works fine after saving the draft and refreshing.

I believe it was aways the behavior. Since it's for the legacy way to do it, I think it's not worth an issue. WDYT?

renatho self-assigned this Jun 6, 2024

renatho mentioned this pull request Jun 6, 2024

Teacher can't add tags to lessons and categories to courses #7612

Open

renatho added this to the 4.24.1 milestone Jun 6, 2024

renatho added the No Changelog label Jun 6, 2024

Update taxonomies to have the default capability

3e0bbe0

renatho force-pushed the fix/capability-issue branch from ec1b70e to 3e0bbe0 Compare June 6, 2024 19:38

renatho added 3 commits June 6, 2024 16:59

Add question capability to teachers

936e5ad

Update taxonomy capabilities

1db8c30

Add taxonomy capabilities

05dc462

renatho commented Jun 6, 2024

View reviewed changes

renatho force-pushed the fix/capability-issue branch from 5860830 to e116930 Compare June 6, 2024 21:01

renatho commented Jun 6, 2024

View reviewed changes

Add specific capabilities to the taxonomies

64dd35f

renatho force-pushed the fix/capability-issue branch from e116930 to 64dd35f Compare June 6, 2024 21:13

renatho marked this pull request as ready for review June 6, 2024 21:45

renatho requested a review from a team June 6, 2024 21:45

renatho changed the title ~~Update taxonomies to have the default capability~~ Fix taxonomy capabilities Jun 6, 2024

renatho removed the No Changelog label Jun 7, 2024

Add changelog

bbc71c7

merkushin self-requested a review June 10, 2024 21:34

merkushin approved these changes Jun 11, 2024

View reviewed changes

renatho merged commit 982fbd4 into trunk Jun 11, 2024
23 checks passed

renatho deleted the fix/capability-issue branch June 11, 2024 18:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix taxonomy capabilities #7613

Fix taxonomy capabilities #7613

renatho commented Jun 6, 2024 •

edited

Loading

github-actions bot commented Jun 6, 2024

github-actions bot commented Jun 6, 2024

github-actions bot commented Jun 6, 2024

renatho Jun 6, 2024 •

edited

Loading

renatho Jun 6, 2024 •

edited

Loading

renatho Jun 6, 2024

github-actions bot commented Jun 6, 2024

github-actions bot commented Jun 6, 2024

renatho Jun 6, 2024 •

edited

Loading

github-actions bot commented Jun 6, 2024

renatho commented Jun 7, 2024

github-actions bot commented Jun 7, 2024

merkushin left a comment

renatho commented Jun 11, 2024

Fix taxonomy capabilities #7613

Fix taxonomy capabilities #7613

Conversation

renatho commented Jun 6, 2024 • edited Loading

Proposed Changes

Alternative approach

Context

Known issues

Testing Instructions

Pre-Merge Checklist

github-actions bot commented Jun 6, 2024

github-actions bot commented Jun 6, 2024

github-actions bot commented Jun 6, 2024

renatho Jun 6, 2024 • edited Loading

Choose a reason for hiding this comment

renatho Jun 6, 2024 • edited Loading

Choose a reason for hiding this comment

renatho Jun 6, 2024

Choose a reason for hiding this comment

github-actions bot commented Jun 6, 2024

github-actions bot commented Jun 6, 2024

renatho Jun 6, 2024 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Jun 6, 2024

renatho commented Jun 7, 2024

github-actions bot commented Jun 7, 2024

merkushin left a comment

Choose a reason for hiding this comment

1. It is related to the test instructions.

2. Course Outline in the lesson preview for teacher

3. Assign module in the lesson for a legacy course

renatho commented Jun 11, 2024

renatho commented Jun 6, 2024 •

edited

Loading

renatho Jun 6, 2024 •

edited

Loading

renatho Jun 6, 2024 •

edited

Loading

renatho Jun 6, 2024 •

edited

Loading