The latest commit to the WP-Discourse plugin is causing all the custom posts (made through EventON Plugin) to be attributed to system user despite the user existing on both discourse and WordPress.
If we roll back to 2.3.7, it works as expected but updating to 2.3.8 causes this bug to happen.
We receive this error via emails:
Reason for failure:
A 400 response code was returned from Discourse.
param is missing or the value is empty: post
Did you mean? post
post[raw]
controller
title
I thought it might be helpful in identifying the probable cause.
[2022-02-21 08:07:11] publish.INFO: create_post.post_success {"wp_title":"[Please Ignore] Test Event","wp_author_id":"3958","wp_post_id":126070,"discourse_post_id":""}
[2022-02-21 08:07:11] publish.INFO: create_post.body_valid {"wp_title":"[Please Ignore] Test Event","wp_author_id":"3958","wp_post_id":126070,"discourse_post_id":""}
The post was correctly linked to my user account on both wordpress and discourse with 2.3.7
v2.3.8:
[2022-02-21 08:10:15] publish.INFO: create_post.post_success {"wp_title":"[Please Ignore] Another test event","wp_author_id":"3958","wp_post_id":126071,"discourse_post_id":""}
[2022-02-21 08:10:15] publish.INFO: create_post.body_valid {"wp_title":"[Please Ignore] Another test event","wp_author_id":"3958","wp_post_id":126071,"discourse_post_id":""}
The post was linked to my user on wordpress and system user on discourse on 2.3.8
Sorry for the noise, My issue seems to have been fixed on WordPress 5.9.1 & WP Discourse 2.3.9
But, it seems like discourse is now doing some extra work on each published post and the ownership is being transferred from System user to the publishing user after the fact?
Hey @orenwolf, Iâm sorry to hear youâre still having an issue. Could you confirm that the users youâre expecting to be publishing under their own name have a Discourse Username in their Wordpress profile?
Generally guys, thanks for your patience on this. On my own testing on various sites (and in the pluginâs own unit tests), the Discourse Username feature is now functioning as expected on 2.3.9. If youâre still having an issue please confirm youâre on the latest version of the plugin and that the user youâre expecting to be the author of the post has a Discourse Username.
You might be wondering why this issue arose at all. I think itâll be helpful if I give a bit of background (which will also answer your question @itsbhanusharma). Previously, the way this feature worked is that it used different users in the Api-Username header (see here). The reason this was seen as necessary was because the relevant endpoint in Discourse does not support setting a creator of the post different from the user performing the API request.
The upshot of this was that the only way this feature would work is if you have a âAll Usersâ API key with a âGlobalâ scope. Iâll just note that for some time the standard instructions for creating an API key for the WP Discourse plugin are as follows
If you havenât yet created an API key, Click âNew API Keyâ, set User Level to âSingle Userâ, set âUserâ to an admin account, select âGlobal Keyâ and click âSaveâ. Copy and paste the API key here.
Following these instructions would mean that this (undocumented) feature would not work, and it has caused issues for various sites.
Moreover, for various security reasons, Iâve progressively been making changes to the plugin to allow for much more specific API keys to be used. This will require a change to Discourse, and (when it gets merged) will allow plugin admins to issue themselves a new, much more limited, API key. Iâll be making an announcement about that when the time comes.
Yes @itsbhanusharma the way the feature now works is by making a second request to change the owner of the post after it is created (if a Discourse Username is present). That is actually currently the only proper way to arbitrarily set the owner of a post via the Discourse API (without needing to use the Api-Username and an All Users Global Key in the way described above). Considering the type of operation this is, this should not be a performance concern.
Itâs not a performance concern, just a nuisance to explain less savvy people that the pencil icon on top of their post is normal and thatâs how Itâs going to be.
Itâll take some time but eventually weâll get used to it.
It is somewhat offputting that posts are shown as edited, but thatâs fine as long as everything works.
However, itâs a problem that notifications are wrong. They show the new post being created by the system user.
So far this just feels like a hack, not a solution. Itâs certainly a big step backwards to not be able to simply post as the proper user automatically. Iâm not sure I understand what caused this to break in the first place.
The short version is that Iâve been slowly changing the way the plugin handles all of its requests to discourse for various reasons, particularly testing and security. The full context and rationale for the changes is too long to get into here. I appreciate that in the context of this particular feature it may feel like âif it ainât broke donât fix itâ, however thereâs a broader context here.
These changes have been going on for some time (months), however the reason theyâre coming to the surface now is because I made a mistake in the 2.3.8 release. So I included the change that should have been in that release in 2.3.9.
That said, @jtbayly@itsbhanusharma I hear your feedback on the different approach to this particular feature. I understand it may feel like a hack. Itâs not. Nevertheless, given your feedback, Iâm going to add the existing way back in to the plugin behind a setting you can use if you wish (it will go live in 2.4.0). Iâll follow up with note when thatâs merged in the next few days.
I hope to be able to remove this approach entirely when Iâve addressed the issues youâve both raised, most likely with some further changes to discourse/discourse. As mentioned, Iâm going to be making a larger announcement about changes to how the plugin handles API keys within the next month (depending on when changes get merged to discourse/discourse), which will cover aspects of this.
When I said this it was meant to acknowledge that I wasnât sure if there was any other way forward. Wasnât meant to be a âwhyâd you go and break it!â comment.
Very thankful for your work keeping the WP plug-in working with an updated core Discourse. And very happy there are (likely) coming changes to core that will allow for improvement in this area.
