Improves permissions checks for the Bulk Clone action and the republishing of a copy.

[enricobattocchi]

Context

• Improves permissions checks for the Bulk Clone action and the republishing of a copy.

Summary

This PR can be summarized in the following changelog entry:

• Improves security of the Bulk Clone action and the republishing of a copy.

Relevant technical choices:

Test instructions

Test instructions for the acceptance test before the PR gets merged

This PR can be acceptance tested by following these steps:

• Follow the instructions detailed in https://github.com/Yoast/reserved-tasks/issues/1018

Relevant test scenarios

• Changes should be tested with the browser console open
• Changes should be tested on different posts/pages/taxonomies/custom post types/custom taxonomies
• Changes should be tested on different editors (Default Block/Gutenberg/Classic/Elementor/other)
• Changes should be tested on different browsers
• Changes should be tested on multisite

Test instructions for QA when the code is in the RC

• QA should use the same steps as above.

QA can test this PR by following these steps:

Impact check

This PR affects the following parts of the plugin, which may require extra testing:

UI changes

• This PR changes the UI in the plugin. I have added the 'UI change' label to this PR.

Documentation

• I have written documentation for this change. For example, comments in the Relevant technical choices, comments in the code, documentation on Confluence / shared Google Drive / Yoast developer portal, or other.

Quality assurance

• I have tested this code to the best of my abilities
• I have added unittests to verify the code works as intended

Innovation

• No innovation project is applicable for this PR.
• This PR falls under an innovation project. I have attached the innovation label and noted the work hours.

Fixes https://github.com/Yoast/reserved-tasks/issues/1018

[Copilot]

Pull request overview

This PR enhances security by adding permission checks to prevent unauthorized users from cloning or republishing posts they don't have edit access to. The changes ensure that bulk clone and rewrite-and-republish operations skip posts where the user lacks appropriate permissions, with proper feedback provided to the user.

Changes:

• Added permission checks in bulk action handlers to verify users can edit posts before cloning or rewriting
• Implemented skip counters and new query parameters to track and display skipped items
• Added a permission check in the republish request handler to prevent unauthorized republishing

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/handlers/bulk-handler.php	Added current_user_can('edit_post') checks in clone and rewrite bulk action handlers, with skip tracking
src/watchers/bulk-actions-watcher.php	Added handling for new bulk_cloned_skipped and bulk_rewriting_skipped query parameters with warning notices
src/post-republisher.php	Added permission check to prevent republishing when user cannot edit the original post
tests/WP/Post_Republisher_Test.php	Added test verifying republish_request dies when user cannot edit the original post
tests/Unit/Watchers/Bulk_Actions_Watcher_Test.php	Added tests for displaying skip notices in bulk clone and rewrite operations
tests/Unit/Handlers/Bulk_Handler_Test.php	Added comprehensive tests for permission checks in bulk clone and rewrite handlers

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coveralls]

Pull Request Test Coverage Report for Build 21648102573

Details

• 62 of 65 (95.38%) changed or added relevant lines in 3 files are covered.
• 1 unchanged line in 1 file lost coverage.
• Overall coverage increased (+1.8%) to 59.642%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/handlers/bulk-handler.php	26	29	89.66%

Files with Coverage Reduction	New Missed Lines	%
src/post-republisher.php	1	77.46%

Totals
Change from base Build 21609297401:	1.8%
Covered Lines:	1599
Relevant Lines:	2681

---

💛 - Coveralls

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.