Skip to content

Add permission checks to Command Palette commands #71267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 13 commits into from
Sep 2, 2025
Merged

Add permission checks to Command Palette commands #71267

merged 13 commits into from
Sep 2, 2025

Conversation

@R1shabh-Gupta
Copy link
Contributor

@R1shabh-Gupta R1shabh-Gupta commented Aug 20, 2025 •
edited
Loading

What?

Closes #71263

Adds permission checks to Command Palette commands to prevent unauthorized users from accessing post, page, and patterns.

Why?

The Command Palette was showing "Add Post", "Add Page", and "Patterns" commands to all users, regardless of their permissions. This created a security vulnerability where users without proper capabilities could see and potentially attempt to access creation functions they shouldn't have access to. This PR ensures only users with the appropriate permissions can see and use these commands.

How?

  • Add Post command: Added canCreatePost permission check using canUser('create', { kind: 'postType', name: 'post' }) and disabled the command when the user lacks permission
  • Add Page command: Added canCreatePage permission check using canUser('create', { kind: 'postType', name: 'page' }) and conditionally register the command only when user has permission
  • Patterns command: Added canCreatePatterns permission check using canUser('create', { kind: 'postType', name: 'wp_block' }) and show the command only when user can create templates OR patterns, with appropriate fallback navigation

The implementation uses WordPress's canUser selector to check user capabilities before displaying commands.

Testing Instructions

  1. Log in as an Administrator user
  2. Open the Command Palette (Ctrl/Cmd + K)
  3. Verify you can see "Add Post", "Add Page", and "Patterns" commands
  4. Log in as a user with limited permissions (e.g., Subscriber role)
  5. Open the Command Palette (Ctrl/Cmd + K)
  6. Verify that commands you don't have permission for are either disabled or hidden
  7. Try different user roles (Editor, Author, etc.) to test various permission levels

Screenshots or screencast

Screen.Recording.2025-08-20.at.2.11.09.PM.mov

@t-hamano t-hamano added [Type] Bug An existing feature does not function as intended [Package] Core commands labels Aug 20, 2025
@R1shabh-Gupta R1shabh-Gupta marked this pull request as ready for review August 20, 2025 09:17
@github-actions
Copy link

github-actions bot commented Aug 20, 2025 •
edited
Loading

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: R1shabh-Gupta <rishabhwp@git.wordpress.org>
Co-authored-by: t-hamano <wildworks@git.wordpress.org>
Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

t-hamano
t-hamano reviewed Aug 21, 2025
View reviewed changes
@R1shabh-Gupta R1shabh-Gupta requested a review from t-hamano August 21, 2025 08:21
t-hamano
t-hamano approved these changes Aug 21, 2025
View reviewed changes
Copy link
Contributor

@t-hamano t-hamano left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍 Finally, can you resolve the conflicts? It should not be difficult, as the conflict is small.

@t-hamano
Copy link
Contributor

t-hamano commented Aug 22, 2025

@R1shabh-Gupta, sorry, can you merge the latest trunk into this PR to fix the failing CIs?

I think this PR doesn't cause any new CI failures, but I'm 100% unsure whether the following error isn't related to this PR:

https://github.com/WordPress/gutenberg/actions/runs/17121572254/job/48567238274?pr=71267

@t-hamano
Copy link
Contributor

t-hamano commented Aug 22, 2025

Hmm, the failing e2e test is certainly related to this PR.

image

@Mamaduka, this PR checks the user permissions to conditionally execute commands (Page, Post, and Patterns). I suspect that this causes additional preloading, so we need to update the test side. Is my understanding correct?

@Mamaduka
Copy link
Member

Mamaduka commented Sep 2, 2025

Thanks for the ping and sorry for the late reply.

Yes, it appears that PR introduces a new HTTP request early in the loading stages, which we try to avoid; the failing e2e test is here to catch those early.

I think we can resolve the current problem by switching the core/add-new-post command to use the useCommandLoader pattern.

Side Note: I think it might be helpful to introduce a better API for checking permissions for commands, something that's lazily evaluated and not on page load. This could be a good addition to #59004. cc @youknowriad

@R1shabh-Gupta
Copy link
Contributor Author

R1shabh-Gupta commented Sep 2, 2025

Thanks for the update!
I’ve refactored the code to use the useCommandLoader pattern. I also tested the failing Playwright check locally, and it’s passing now.

@Mamaduka
Copy link
Member

Mamaduka commented Sep 2, 2025

@R1shabh-Gupta, it looks like there is a merge conflict that requires rebasing. That should also resolve CI checks.

t-hamano
t-hamano approved these changes Sep 2, 2025
View reviewed changes
Copy link
Contributor

@t-hamano t-hamano left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@R1shabh-Gupta Thanks for the update!

@Mamaduka can we merge this PR?

@Mamaduka
Copy link
Member

Mamaduka commented Sep 2, 2025

@t-hamano, yes. This is good to merge 👍

@t-hamano t-hamano merged commit 0dbeaef into WordPress:trunk Sep 2, 2025
77 of 78 checks passed
@github-actions github-actions bot added this to the Gutenberg 21.6 milestone Sep 2, 2025
@maxschmeling maxschmeling mentioned this pull request Oct 7, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@t-hamano t-hamano t-hamano approved these changes

Assignees

No one assigned

Labels

[Package] Core commands [Type] Bug An existing feature does not function as intended

Projects

None yet

Milestone

Gutenberg 21.6

Development

Successfully merging this pull request may close these issues.

Command Palette: Add permission check to "Patterns", "Add Post", "Add Page"

3 participants

@R1shabh-Gupta @t-hamano @Mamaduka