Keep the password gate on generated captions in the edit context

jorgefilipecosta · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026
commit c1cc367752a62aeddc7675230f0d00f9a42aa7ef
@@ -191,8 +191,7 @@ public function check_permission( $input = array() ): bool {
 	 *
 	 * {@see WP_Ability::execute()} always runs {@see self::check_permission()} first, so a
 	 * single item is only looked up again here, while each collection row is checked. The
-	 * global post, which each prepared item replaces, and the password check are restored
-	 * afterwards.
+	 * global post, which each prepared item replaces, is restored afterwards.
 	 *
 	 * @since x.x.x
 	 *
@@ -205,11 +204,6 @@ public function execute_media_query( $input = array() ) {
 
 		try {
 			if ( isset( $request['id'] ) ) {
-				// Allow access to all password protected posts if the context is edit.
-				if ( 'edit' === $request['context'] ) {
-					add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
-				}
-
 				return $this->get_item( $request );
 			}
 
@@ -226,8 +220,6 @@ public function execute_media_query( $input = array() ) {
 
 			return $this->get_items( $request );
 		} finally {
-			remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
-
 			if ( $previous_post instanceof WP_Post ) {
 				// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Restores the previous global post.
 				$GLOBALS['post'] = $previous_post;
@@ -334,32 +326,6 @@ private function get_items_permissions_check( array $request ): bool {
 		return 'edit' !== $request['context'] || ( $post_type && current_user_can( $post_type->cap->edit_posts ) ); // phpcs:ignore WordPress.WP.Capabilities.Undetermined -- Capability is resolved from the post type's capability object.
 	}
 
-	/**
-	 * Overrides the result of the post password check for requested attachments.
-	 *
-	 * Allows users to read the content of password protected posts if they have the
-	 * `edit_post` capability for the post being checked.
-	 *
-	 * @since x.x.x
-	 *
-	 * @param bool          $required Whether the post requires a password check.
-	 * @param \WP_Post|null $post     The post been password checked.
-	 * @return bool Result of password check taking into account the edit capability.
-	 */
-	public function check_password_required( $required, $post ) {
-		if ( ! $required ) {
-			return $required;
-		}
-
-		$post = get_post( $post );
-
-		if ( ! $post ) {
-			return $required;
-		}
-
-		return ! current_user_can( 'edit_post', $post->ID );
-	}
-
 	/**
 	 * Retrieves a collection of attachments.
 	 *
@@ -434,11 +400,6 @@ private function get_items( array $request ) {
 		/** @var \WP_Post[] $query_result The query does not ask for IDs only. */
 		$query_result = $posts_query->query( $query_args );
 
-		// Allow access to all password protected posts if the context is edit.
-		if ( 'edit' === $request['context'] ) {
-			add_filter( 'post_password_required', array( $this, 'check_password_required' ), 10, 2 );
-		}
-
 		$posts = array();
 
 		update_post_author_caches( $query_result );
@@ -458,11 +419,6 @@ private function get_items( array $request ) {
 			$posts[] = $this->prepare_item_for_response( $post, $request );
 		}
 
-		// Reset filter.
-		if ( 'edit' === $request['context'] ) {
-			remove_filter( 'post_password_required', array( $this, 'check_password_required' ) );
-		}
-
 		$page        = (int) ( $query_args['paged'] ?? 0 );
 		$total_posts = $posts_query->found_posts;
 

@@ -1759,12 +1759,12 @@ public function test_rendered_fields_apply_the_display_filters(): void {
 	}
 
 	/**
-	 * With raw fields, the password of an item the user can edit does not gate its rendered
-	 * caption, which core generates from the description when the caption is empty.
+	 * Raw fields do not lift an item's password: the rendered caption, which core generates
+	 * from the description when the caption is empty, stays gated.
 	 *
 	 * @since x.x.x
 	 */
-	public function test_raw_fields_unlock_password_protected_items_the_user_can_edit(): void {
+	public function test_raw_fields_keep_the_password_gate_on_generated_captions(): void {
 		$attachment_id = self::factory()->attachment->create_object(
 			self::$test_file,
 			0,
@@ -1784,17 +1784,9 @@ public function test_raw_fields_unlock_password_protected_items_the_user_can_edi
 			)
 		);
 		$collection = $this->execute( array( 'fields' => $fields ) );
-		$view       = $this->execute(
-			array(
-				'id'     => $attachment_id,
-				'fields' => array( 'caption_rendered' ),
-			)
-		);
 
-		$this->assertSame( "<p>Secret description</p>\n", $single['caption_rendered'], 'The single item should not be gated by the password.' );
-		$this->assertSame( "<p>Secret description</p>\n", $collection['media'][0]['caption_rendered'], 'The collection item should not be gated by the password.' );
-		$this->assertStringNotContainsString( 'Secret description', $view['caption_rendered'], 'Without raw fields, the password should gate the generated caption.' );
-		$this->assertTrue( post_password_required( $attachment_id ), 'The password gate should be restored afterwards.' );
+		$this->assertStringContainsString( 'password-protected', $single['caption_rendered'], 'The single item caption should stay gated.' );
+		$this->assertStringContainsString( 'password-protected', $collection['media'][0]['caption_rendered'], 'The collection item caption should stay gated.' );
 	}
 
 	/**