The-seo-framework: editor user and resize social image

[domegang]

hi,
on my blog an editor reported me an error during the resize of the social image. My debug log files is blank and i don't understand the problem. This problem occurs with non-admin users. it can be linked to the user roles/permissions ? How i can solve. Thank you

[sybrew]

Thanks for the bug report! I'll go test it out ASAP. Will report back.

[sybrew]

Confirmed!

The user requires "customizer" permissions, and it's very difficult to track and see on how to adjust this.
I think cropping wasn't meant to be used in plugins 😅. This might require a rewrite...
Its fix is planned for the upcoming update, but I might have to shift this to 2.9.x or even 3.x

[sybrew]

Okay, so here's the deal... the issues are:

1. WordPress blocks users who don't have customizer access. I believe this is wrong.
2. WordPress attaches permissions to each attachment, based on who uploaded it. Therefore, they only create nonces for specific users.
3. This nonce must be used for security reasons, we use it and it is checked against.

Now, the issue at "1." can be circumvented. The 2nd and 3rd rule are plainly annoying and requires a lot of thinking before we counter them.

So, there are several solutions, what do you think?

1. Use our own nonce. The old image isn't overwritten, so why would we require permissions?
2. Only list images the user is allowed to edit (it's possible.. but I don't know if this is easy).
3. Set up our own error code, which is annoyingly displayed only at the far end.
4. Ignore this whole deal and just circumvent issue 1.

[sybrew]

I went for 1., by the way 😄.

The permissions are now upload_files, which excludes "Contributors" but include everyone above.
https://codex.wordpress.org/Roles_and_Capabilities

Cheers!