For a very long time, Polylang allows to synchronize some post properties or metadata across translations. For example, you can synchronize taxonomies and custom fields. The site’s administrator decides this under Languages > Settings > Synchronizations.
How does it work? Let say that you have a post about an event and that this post includes the date of the event as a custom field. You’d like to synchronize this event date across your translations so you activated the custom fields synchronization.
You first write the post in English about this event and select the date. Then you start translating it to German. The event date is copied from the source post to the translation. At some point, you notice that you entered a wrong date. You fix it in the German translation and, as the custom fields are synchronized, the event date is automatically updated by Polylang in the source post too.
But what if the post is translated by someone not having the right to edit the source post and the translator changes the date in the translation? Currently, the custom field will be updated in the source post anyway, as the synchronization takes priority on the user rights.
Starting from Polylang 2.6, the developpers will be able to change this behavior with the filter “pll_pre_current_user_can_synchronize_post” and disallow people not having the right to edit the source post to change synchronized metadatas. If they attempt to do it anyway, Polylang will restore the original value in both the source post and the translated post, to keep values synchronized.
Why did we not change the behavior for everybody? Because some plugins write post metas without checking user rights. For example, WooCommerce stores the product stock in a post meta. When a product is purchased, the stock is decreased by the number of items purchased, even if the customer doesn’t have the right to edit the product. Polylang for WooCommerce takes care of the stock synchronization. If we check the user rights before allowing the stock synchronization, we would break the stock management of WooCommerce. There may also have other cases that we are not aware of, so we decided to keep the user rights check deactivated by default for now.
And what about the post synchronization feature of Polylang Pro? Until now the user rights were not checked either. However, in this case, the risks are not the same. Moreover the synhronization is decided at post level (instead of admin level for the case discussed above). So starting from Polylang Pro 2.6, users won’t be allowed to synchronize a post if they don’t have the right to edit the source post.