Edit Flow Conflict: Workaround and Fix for Security Hazard

A serious conflict has been identified between the Role Scoper and Edit Flow plugins.  Edit Flow defines a custom taxonomy called “post_status”.  The problem occurs when Role Scoper Options are configured to support term-specific Roles and Restrictions for this taxonomy.  Under those conditions, when a new or existing post is saved with “Private” visibility, the visibility is changed to “Public”.

This occurs with all versions of Role Scoper, but only when the Edit Flow plugin is also active.

The workaround is to modify Role Scoper Options as follows.  Navigate to Roles > Options > Realm.  In the “Taxonomy Usage” section, uncheck “post_status”.  Then click the Update button.

Role Scoper version 1.3.34 is also available to eliminate the conflict. Following the workaround or version update, you will still need to manually change any affected posts/pages back to Private visibility and re-save them.

The full change log for this version:

  • Compat : Edit Flow – if ‘post_status’ taxonomy enabled for RS Filtering, editing a Private post forced it to Public visibility
  • BugFix : Non-Administrators could not edit categories if Post Tags enabled for RS filtering
  • BugFix : Links were not displayed to non-Administrators if multiple sort fields specified in get_bookmarks() call

Some technical details on the source of this conflict are discussed here.