diff --git a/functions.php b/functions.php index 2be3aea..9299b91 100755 --- a/functions.php +++ b/functions.php @@ -581,17 +581,19 @@ function thalim_membres_can_edit_post( $allcaps, $caps, $args, $user ) { // Meta caps that carry a post ID in $args[2] (e.g. wp-admin/post.php load). $meta_caps_with_id = [ 'edit_post', 'edit_page' ]; - // Primitive caps called during the admin save/publish flow *without* a + // Primitive caps called during the admin save flow *without* a // post_id (e.g. wp-admin/includes/post.php:76 checks edit_others_posts // directly when $post_author !== current user). We infer the post_id from // the request so we can still authorize membres per-post. + // + // NOTE: publish_posts / publish_pages are intentionally NOT in this list — + // contributors listed in `membres` must be able to edit (incl. published) + // posts of the lab, but only editors/admins should be able to publish. $primitive_caps_in_save_flow = [ 'edit_others_posts', 'edit_others_pages', 'edit_published_posts', 'edit_published_pages', - 'publish_posts', - 'publish_pages', ]; $post_id = 0;