Skip to content

fix: Add missing capability for editing SEO settings #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dtakken wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: Add missing capability for editing SEO settings #128

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions web/app/themes/sage/config/user-roles.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@
'gravityforms_edit_entry_notes',
],
'seo_redirections' => [
'edit_posts',

@mvdhoek1 mvdhoek1 Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check even of dit niet teveel rechten geeft aan deze 'eenvoudige' rol, volgens mij kunnen ze zo de rol van editor aannemen?

@dtakken dtakken Jun 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dit blijkt bij nader inzien inderdaad te veel rechten te geven. Het lijkt er nu op dat toegang tot redirections niet via alleen caps te regelen is....

@mvdhoek1 mvdhoek1 Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Zoals al vermeld in Teams:

Het gaat hier fout:

if ( current_user_can( 'manage_options' ) ) {
    add_action( 'init', 'seopress_404_fn', 10 );
} else {
    add_action( 'admin_init', 'seopress_404_fn', 10 );
}

Locatie: web/app/plugins/wp-seopress-pro/inc/admin/redirections/redirections.php

Voor rollen zonder manage_options wordt de post type pas geregistreerd op de admin_init hook.

WordPress controleert voor dat moment of de post type bestaat. Omdat seopress_404 op dat moment nog niet bestaat herkent WordPress de pagina /wp-admin/edit.php?post_type=seopress_404 niet en blokkeert de toegang.

Door onderstaande toe te voegen werkt ie wel:

    /**
     * Registers the redirections post type if it doesn't exist yet. This is needed for the redirections to work for users
     * that don't have the 'manage_options' capability, but do have the 'edit_redirections' capability.
     */
    #[Action('init', 10)]
    public function registerRedirectionsPostType(): void
    {
        global $pagenow;
 
        if (! is_string($pagenow) || 0 === strlen(trim($pagenow))) {
            return;
        }
 
        $redirectionPages = ['edit.php', 'post.php', 'post-new.php'];
 
        if (
            ! is_admin()
            || ! in_array($pagenow, $redirectionPages, true)
            || ('edit.php' === $pagenow && isset($_GET['post_type']) && 'seopress_404' !== $_GET['post_type'])
            || post_type_exists('seopress_404')
            || ! function_exists('seopress_404_fn')
        ) {
            return;
        }
 
        seopress_404_fn();
    }

En dan de bestaande filter aanpassing: (brave-hooks)

    #[Filter('seopress_capability')]
    public function dashboardOptions(string $cap, string $context): string
    {
        if (! is_admin()) {
            return $cap;
        }
 
        if ('bot' == $context) {
            $cap = 'edit_posts';
        }
 
        // Lower the main SEO menu cap from manage_options to edit_redirections so roles without manage_options can access it.
        if ('menu' == $context && 'manage_options' === $cap) {
            return 'edit_redirections';
        }
 
        return $cap;
    }

Een gebruiker met deze rol werkt nu bij mij:

        'payer' => [
            'display_name' => 'Betaler',
            'clone' => [
                'from' => 'subscriber',
                'add' => [
                    'caps' => [
                        'read',
                        'wf2fa_activate_2fa_self',
                    ],
                    'post_type_caps' => [],
                    'cap_groups' => [
                        'wpseo',
                    ],
                ],
                'remove' => [
                    'caps' => [],
                    'post_type_caps' => [],
                    'cap_groups' => [],
                ],
            ],
        ],

'wpseo_bulk_edit',
'wpseo_manage_options',
'edit_redirection',
Expand Down
Loading