Roles add_cap should call update_user_level_from_caps()

[lgladdy]

Hey guys,

I've created a new user role, which didn't appear in the Author drop down list due to #16841. The workaround is to add a level_1 capability to that user, but because wordpress doesn't call update_user_level_from_caps() function when you add_cap, that isn't actually applied to existing users on the role, and you have to move them to a different role and back again if you want to apply the changed user role.

I'd suggest adding a call to update_user_level_from_caps() to add_cap (and remove_cap) to fix this in wp-includes/capabilities.php

[nacin]

Hi lgladdy, sorry you never received a reply here. I'm trying to figure out what's going on. update_user_level_from_caps() gets called when you add a role to a user, which is what you'd be doing when you create a new user role. So maybe the API could do a little more, but I'm not quite sure what the bug is.

[lgladdy]

Hey Nacin,

It's been a little while since i opened this, so i'm trying to recall our use case, I think it was basically that when you add a deprecated level_x capability to a role, any users who already have that role aren't updated with that capability, because update_user_level_from_caps() isn't called as part of the add_cap.

Looking back, this probably isn't too much of an issue depending on the state of #16841 - I've not needed to do anything with caps in recent releases, but this was back in 3.3 so it may well be something that's changed since then!

[SergeyBiryukov]

Related: #28374

[lgladdy]

Duplicate of #28374.

Reading the patch for #28374, that resolves this ticket :)

[pikamander2]

This appears to still be an issue, at least in 5.8.

I was facing the exact same problem as @lgladdy where my custom role wasn't receiving the capability that I added to it via add_cap().

His blog post (​https://stormconsultancy.co.uk/blog/storm-news/custom-roles-in-wordpress-not-appearing-in-author-lists/) mentioned changing their role to something else and back as a workaround, but instead of trying that I just deleted the user and recreated them, at which point they had the new capability.

@SergeyBiryukov @nacin - Is it possible that there was a regression here at some point?

I see that 5.9 is going to be fixing a semi-related longstanding issue (#16841), so I'd be curious to know if that happens to fix it on its own.

[pikamander2]

(Sorry, I didn't mean to remove it as a duplicate)

I just tried @lgladdy's suggested workaround (changing their role to something else and back) on another affected account and that also fixed it, so it definitely seems like the original bug is still around.

For reference, I'm on WordPress 5.8.2.