Skip to content
This repository has been archived by the owner on Mar 26, 2021. It is now read-only.

trash_post of _any_ type invokes NPR story push delete error if not an admin #72

Open
tamw-wnet opened this issue Jul 29, 2020 · 1 comment

Comments

@tamw-wnet
Copy link

anytime wp_trash_post or trash_post actions are called, nprstory_api_delete is called -- including when someone is deleting their own posts!!! The result is a big fat error message, including when there's nothing to do with the NPR Story API. Offending code below:

function nprstory_api_delete ( $post_ID ) {
  if ( ! current_user_can( 'delete_others_posts' ) ) {
    wp_die(
      __('You do not have permission to delete posts in the NPR API. Users that can delete other users\' posts have that ability: administrators and editors.'),
      __('NPR Story API Error'),
      403
    );
  }

@davidmpurdy
Copy link

Another effect of the way it's currently implemented is that you cannot programmatically delete any post (including CPTs) programmatically (e.g., from a webhook or API call) since there is no current user.

Thank you for identifying this issue and a fix.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants