• Resolved patrikmuse

    (@patrikmuse)


    I’m experiencing a strange bug with PublishPress Permissions. I use the plugin WP File Download on my site to manage downloads. Once the plugin is installed, every time I try to change the order of the folders in WPFD, the plugin bugs out.

    If I uninstall PublishPress Permissions or enable the “pp_unfiltered” permission, everything starts working again, but obviously, I lose the ability to restrict my users.

    How can I fix this issue?

Viewing 10 replies - 1 through 10 (of 10 total)
  • Thread Starter patrikmuse

    (@patrikmuse)

    I would like to clarify two things:

    1. I’m not filtering any permission related to WPFD with your plugin — I have all of them unchecked.
    2. I guess WPFD uses some JavaScript to change the order of the categories — maybe something is being filtered or blocked anyway, regardless of the permissions settings?

      this is the request format when i change order

      https://www.xxxxxxxx.it/wp-admin/admin-ajax.php?action=wpfd&task=category.changeOrder&pk=195&position=first-child&ref=194&dragType=default&security=xxxxxxxxxx
    • This reply was modified 1 year, 1 month ago by patrikmuse.
    Plugin Support Riza Maulana Ardiyanto

    (@rizaardiyanto)

    Hi @patrikmuse

    Thanks for using our plugin.

    Is WPFD plugin is available in ww.wp.xz.cn repository?

    Thread Starter patrikmuse

    (@patrikmuse)

    Hi Riza tnks for your help

    https://www.joomunited.com/wordpress-products/wp-file-download

    this is the plugin

    Thread Starter patrikmuse

    (@patrikmuse)

    We have identified a conflict between WP File Download and PublishPress Permissions (or possibly other PublishPress plugins altering taxonomy access).

    When updating a file (postmeta _wpfd_file_metadata), WP File Download saves the assigned categories in the file_multi_category array.

    → If the user has no categories assigned, a correct value is:

    a:0:{} // Empty array, no categories

    or (if categories are assigned):

    a:2:{i:0;s:4:"1234";i:1;s:4:"5678";}

    The bug:

    When using a non-admin user with PublishPress active (even without specific category restrictions set), sometimes WPFD saves:

    a:1:{i:0;s:0:"";}

    This means the array contains a single empty string as category ID, which is invalid and breaks WPFD internal logic (folders disappearing, errors in category display, broken UI).

    Proof:

    • Same user updating a file:
      • With PublishPress active → Buggy Query → a:1:{i:0;s:0:"";}
      • With PublishPress disabled → Correct Query → a:0:{}

    Root cause hypothesis:

    PublishPress likely filters the result of:

    get_the_terms() get_terms() or other taxonomy queries

    Returning array( '' ) instead of array() when the user has no access or there are no categories visible.

    WPFD doesn’t sanitize this response and directly saves it to the DB → causing the bug.

    In this update, the field file_multi_category (which stores the assigned categories) gets completely emptied — even if the user has full permissions on all WP File Download categories in PublishPress.

    This breaks WP File Download because files lose their category relations after every update.

    query ok

    UPDATE wp_postmeta SET meta_value = '...s:19:"file_multi_category";a:6:{i:0;s:4:"4607";i:1;s:4:"5579";i:2;s:3:"438";i:3;s:4:"4662";i:4;s:4:"4631";i:5;s:4:"5687";}...' WHERE post_id = 123456 AND meta_key = '_wpfd_file_metadata';

    query bug

    UPDATE wp_postmeta SET meta_value = ‘…s:19:”file_multi_category”;a:0:{}…’ WHERE post_id = 123456 AND meta_key = ‘_wpfd_file_metadata’;

    • No taxonomy restriction is applied in PublishPress.
    • The user has all possible category permissions assigned in PublishPress.
    • The issue is strictly related to the PublishPress filter applied on taxonomy terms when saving postmeta.
    • If I disable PublishPress, or add pp_unfiltered to the user, the problem disappears.


      I suspect the problem might be related to this filter in your code:
      add_filter( 'map_meta_cap', '_cme_remap_term_meta_cap', 5, 4 );
      Since WP File Download uses taxonomies to manage categories, this filter may interfere when calling wp_set_object_terms() or other similar functions.
      Could you please check if this could be the reason for the issue?
      Is there any safe way to disable this specific behavior for certain taxonomies (like wpfd_category) or for specific post types (like wpfd_file)?

      Thanks!
    • This reply was modified 1 year, 1 month ago by patrikmuse.
    • This reply was modified 1 year, 1 month ago by patrikmuse.
    • This reply was modified 1 year, 1 month ago by patrikmuse.
    • This reply was modified 1 year, 1 month ago by patrikmuse.
    Plugin Support Riza Maulana Ardiyanto

    (@rizaardiyanto)

    @patrikmuse We want to check this further, but we are prohibited to provide support for commercial product in this forum. As you mentioned, WP File Download is a commercial that does not have free version hosted in WordPress repo, so we will not be able to pursue this further.

    If you decide to purchase our Pro version, you’ll gain access to our private helpdesk where we’ll be happy to assist you in more detail.

    Thread Starter patrikmuse

    (@patrikmuse)

    But regardless of whether the plugin is paid or not, is there a way—even a workaround—to make PublishPress ignore a certain type of query? I just want it not to break the functionality…

    Thread Starter patrikmuse

    (@patrikmuse)

    I’ve realized that once PublishPress (permission) is installed, even if I don’t explicitly select a permission category to filter, it still gets filtered anyway, and permissions are denied to all my users.

    Plugin Support Riza Maulana Ardiyanto

    (@rizaardiyanto)

    @patrikmuse Basically uncheck it here will not get filtered:

    If you feel it still gets filtered, do you have any idea how can we test it without using WP File Download?

    Thread Starter patrikmuse

    (@patrikmuse)

    File and wp file download taxonomy not filtered

    🧨 Bug Description

    When a non-admin user with the studi role renames a WPFD folder, many subfolders disappear or only partially show up (up to the third level).
    The only way to restore visibility is to rename any folder again using an administrator account. 📌 Bug-Triggering Queries (From non-admin role)

    Executed by user studi (role studi):

    UPDATE wp_terms SET name = 'prova131', slug = 'prova131', term_group = 0 WHERE term_id = 5729;

    UPDATE wp_term_taxonomy SET term_id = 5729, taxonomy = 'wpfd-category', description = '{...}', parent = 0 WHERE term_taxonomy_id = 5729;

    INSERT INTO wp_options (option_name, option_value, autoload) VALUES ('wpfd-category_children', 'a:53:{...}', 'auto') ON DUPLICATE KEY UPDATE option_name = VALUES(option_name), option_value = VALUES(option_value), autoload = VALUES(autoload);

    ❌ The serialized array in wpfd-category_children contains only 53 entries, causing loss of relations and hiding folders from the interface.

    Working Queries (From administrator)

    Executed just seconds later by administrator, for the same folder:

    UPDATE wp_terms SET name = 'prova231', slug = 'prova231', term_group = 0 WHERE term_id = 5729;

    UPDATE wp_term_taxonomy SET term_id = 5729, taxonomy = 'wpfd-category', description = '{...}', parent = 0 WHERE term_taxonomy_id = 5729;

    INSERT INTO wp_options (option_name, option_value, autoload) VALUES ('wpfd-category_children', 'a:147:{...}', 'auto') ON DUPLICATE KEY UPDATE option_name = VALUES(option_name), option_value = VALUES(option_value), autoload = VALUES(autoload);

    ✅ The serialized array has 147 entries, and the folder tree is fully preserved.

    🧪 Tests Performed

    • Granted manage_options, edit_terms, manage_categories, and pp_administer_content to the role → bug disappears only with pp_administer_content or pp_unfiltered
    • Tried both filters (no effect):

    add_filter('presspermit_skip_filtering', function($skip, $args) { return isset($args['taxonomy']) && $args['taxonomy'] === 'wpfd-category' ? true : $skip; }, 10, 2);

    add_filter('presspermit_disable_taxonomy_filtering', function ($disable, $taxonomy) { return $taxonomy === 'wpfd-category' ? true : $disable; }, 10, 2);

    ➡️ These filters are not triggered during the AJAX request issued by WPFD when editing categories. 🧩 Technical Summary

    • The non-admin user executes valid queries.
    • But the serialized option wpfd-category_children is truncated under permission filtering.
    • This breaks the folder structure.
    • Only assigning pp_unfiltered or pp_administer_content allows a full, correct update — but these disable all filtering (not acceptable for our use case).

    🙏 Request for Help

    Please help us with:

    1. Why is wpfd-category_children being truncated for non-admin users?
    2. Is there a capability or permission to allow only this option to be saved fully?
    3. Can you provide a filter or exception to bypass permission filtering only when WPFD updates the wpfd-category_children option?
    • This reply was modified 1 year, 1 month ago by patrikmuse.
    Plugin Support Riza Maulana Ardiyanto

    (@rizaardiyanto)

    @patrikmuse Thanks, I created a GitHub issue on this so our developer could check it further: https://github.com/publishpress/PublishPress-Permissions/issues/1552

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘wp file download’ is closed to new replies.