Caps for RSS Feeds by adekbadek · Pull Request #3908 · Automattic/newspack-plugin

adekbadek · 2025-04-11T13:02:54Z

All Submissions:

Have you followed the Newspack Contributing guideline?
Does your code follow the WordPress' coding standards and VIP Go coding standards?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Adds fine-grained capability control to RSS Feeds. This is a first step (and a POC) in granular capability controls to more areas of Newspack.
Before, RSS Feeds CPT inherited from the regular post capabilities, so an administrator would have to allow a user to edit all posts if they wanted them to edit RSS Feeds.

How to test the changes in this Pull Request:

Confirm that as an Editor and as an Admin, you can still manage RSS Feeds
Install capability-manager-enhanced plugin
Go to Capabilities → Roles and add a new role
In Capabilities → Capabilities edit the role and give it Posts -> Edit* cap and all caps in RSS Feeds:

Also add Admin → Read capability

Create a new user with this role
Log in as the user and observe that you cannot see any existing posts, but you can manage RSS Feeds

* WC will mess with admin login for users without edit_posts cap

Other information:

Have you added an explanation of what your changes do and why you'd like us to include them?
Have you written new tests for your changes, as applicable?
Have you successfully ran tests with your changes locally?

To see the specific tasks where the Asana app for GitHub is being used, see below:
- https://app.asana.com/0/0/1204478788464366

dkoo

Not sure if this is related to these changes or the capability-manager-enhanced plugin, but a user with these capabilities can't access the main dashboard page, resulting in an error screen immediately after logging in:

If I paste the /wp-admin/edit.php?post_type=partner_rss_feed URL directly into the browser, I can access this page and I also have access to some other menu items. Most of these are probably tied to the edit_posts capability, however because the user lacks edit_others_posts most of the features within these menu items are unusable.

adekbadek · 2025-05-29T09:50:27Z

Admin → Read capability was missing.

I've updated the instructions.

miguelpeixe

Working as described!

It's unfortunate that we have to call current_user_can( get_post_type_object( $post_type )->cap->edit_others_posts ) instead of the simpler current_user_can( 'edit_others_posts' ) for these entities now.

Would it make sense for \Newspack\Capabilities to provide a more straightfoward way to get that value?

adekbadek · 2025-06-16T08:37:10Z

Would it make sense for \Newspack\Capabilities to provide a more straightfoward way to get that value?

Good idea, added Capabilities::current_user_can method

miguelpeixe

💯

github-actions · 2025-06-20T07:14:19Z

Hey @adekbadek, good job getting this PR merged! 🎉

Now, the needs-changelog label has been added to it.

Please check if this PR needs to be included in the "Upcoming Changes" and "Release Notes" doc. If it doesn't, simply remove the label.

If it does, please add an entry to our shared document, with screenshots and testing instructions if applicable, then remove the label.

Thank you! ❤️

# [6.12.0-alpha.1](v6.11.2...v6.12.0-alpha.1) (2025-07-03) ### Bug Fixes * **menu:** don't hide sponsors menu if the user can't see the newspack dashboard ([#4041](#4041)) ([f988bd2](f988bd2)) * saving name when registering user ([#4050](#4050)) ([498028e](498028e)) * **woocommerce-memberships:** prevent membership expiry if there's another active subscription ([#4009](#4009)) ([6b42cbd](6b42cbd)) ### Features * **capabilities:** add caps for RSS Feeds ([#3908](#3908)) ([2620c54](2620c54)) * **collections:** add hierarchical fields ([#4051](#4051)) ([3f5a704](3f5a704)) * **collections:** allow overriding "collection" names and slugs ([#4033](#4033)) ([f5523b0](f5523b0)) * **collections:** support multiple CTAs in collections meta ([#4049](#4049)) ([d445444](d445444)) * modal checkout for My Account's reorders ([#3988](#3988)) ([fd347bc](fd347bc)) * **my-account:** subscription payment notice ([#4029](#4029)) ([4b78d7f](4b78d7f)) * **rss:** Custom Tracking snippet ([#4047](#4047)) ([2e682c5](2e682c5)) * **rss:** Hooks extending RSS ([#4055](#4055)) ([da97ff4](da97ff4)) * **rss:** Skip non-distributable images ([#4052](#4052)) ([9fdfe78](9fdfe78)) * show "deleted" label on segments if list, subscription, or plan was deleted [NPPM-2031] ([#4021](#4021)) ([4dec8bb](4dec8bb)) * **woocommerce:** rename WooCommerce Payments to WooPay ([#4048](#4048)) ([1528cad](1528cad))

matticbot · 2025-07-03T19:36:59Z

🎉 This PR is included in version 6.12.0-alpha.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

# [6.12.0](v6.11.3...v6.12.0) (2025-07-14) ### Bug Fixes * **menu:** don't hide sponsors menu if the user can't see the newspack dashboard ([#4041](#4041)) ([f988bd2](f988bd2)) * saving name when registering user ([#4050](#4050)) ([498028e](498028e)) * **woocommerce-memberships:** prevent membership expiry if there's another active subscription ([#4009](#4009)) ([6b42cbd](6b42cbd)) ### Features * **capabilities:** add caps for RSS Feeds ([#3908](#3908)) ([2620c54](2620c54)) * **collections:** add hierarchical fields ([#4051](#4051)) ([3f5a704](3f5a704)) * **collections:** allow overriding "collection" names and slugs ([#4033](#4033)) ([f5523b0](f5523b0)) * **collections:** support multiple CTAs in collections meta ([#4049](#4049)) ([d445444](d445444)) * modal checkout for My Account's reorders ([#3988](#3988)) ([fd347bc](fd347bc)) * **my-account:** subscription payment notice ([#4029](#4029)) ([4b78d7f](4b78d7f)) * **rss:** Custom Tracking snippet ([#4047](#4047)) ([2e682c5](2e682c5)) * **rss:** Hooks extending RSS ([#4055](#4055)) ([da97ff4](da97ff4)) * **rss:** Skip non-distributable images ([#4052](#4052)) ([9fdfe78](9fdfe78)) * show "deleted" label on segments if list, subscription, or plan was deleted [NPPM-2031] ([#4021](#4021)) ([4dec8bb](4dec8bb)) * **woocommerce:** rename WooCommerce Payments to WooPay ([#4048](#4048)) ([1528cad](1528cad))

matticbot · 2025-07-14T18:04:46Z

🎉 This PR is included in version 6.12.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

adekbadek added 2 commits April 10, 2025 10:15

feat: add granular capabilities to RSS Feed CPT

e5ff993

test: add tests

1572806

adekbadek added the [Status] Needs Review The issue or pull request needs to be reviewed label Apr 11, 2025

adekbadek requested a review from a team as a code owner April 11, 2025 13:02

adekbadek changed the title ~~Feat/granular permissions~~ Caps for RSS Feeds Apr 11, 2025

fix: conditions in mapping

37fa34d

adekbadek mentioned this pull request Apr 15, 2025

per-wizard capabilities #3920

Draft

6 tasks

dkoo requested changes May 14, 2025

View reviewed changes

Merge branch 'trunk' into feat/granular-permissions

f62f5a1

adekbadek requested a review from dkoo May 29, 2025 09:51

miguelpeixe approved these changes Jun 13, 2025

View reviewed changes

adekbadek added 2 commits June 16, 2025 09:50

Merge branch 'trunk' into feat/granular-permissions

ca92891

refactor: add current_user_can method

a5b5721

adekbadek requested a review from miguelpeixe June 16, 2025 08:37

test: fix tests

b7bc785

miguelpeixe approved these changes Jun 16, 2025

View reviewed changes

github-actions bot added [Status] Approved The pull request has been reviewed and is ready to merge and removed [Status] Needs Review The issue or pull request needs to be reviewed labels Jun 16, 2025

adekbadek merged commit 2620c54 into trunk Jun 20, 2025
8 checks passed

adekbadek deleted the feat/granular-permissions branch June 20, 2025 07:14

github-actions bot added the needs-changelog label Jun 20, 2025

adekbadek removed the needs-changelog label Jun 20, 2025

matticbot added the released on @alpha label Jul 3, 2025

matticbot added the released label Jul 14, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Caps for RSS Feeds#3908

Caps for RSS Feeds#3908
adekbadek merged 7 commits intotrunkfrom
feat/granular-permissions

adekbadek commented Apr 11, 2025 •

edited

Loading

Uh oh!

dkoo left a comment

Uh oh!

adekbadek commented May 29, 2025

Uh oh!

miguelpeixe left a comment

Uh oh!

adekbadek commented Jun 16, 2025

Uh oh!

miguelpeixe left a comment

Uh oh!

Uh oh!

github-actions bot commented Jun 20, 2025

Uh oh!

matticbot commented Jul 3, 2025

Uh oh!

matticbot commented Jul 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

adekbadek commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

All Submissions:

Changes proposed in this Pull Request:

How to test the changes in this Pull Request:

Other information:

Uh oh!

dkoo left a comment

Choose a reason for hiding this comment

Uh oh!

adekbadek commented May 29, 2025

Uh oh!

miguelpeixe left a comment

Choose a reason for hiding this comment

Uh oh!

adekbadek commented Jun 16, 2025

Uh oh!

miguelpeixe left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jun 20, 2025

Uh oh!

matticbot commented Jul 3, 2025

Uh oh!

matticbot commented Jul 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

adekbadek commented Apr 11, 2025 •

edited

Loading