Post gets published instead of pending

I’ve recently encountered a problem with the new WordPress 2.3. While this problem only occurs when using a plugin like Role Manager to change roles and capabilities, it’s in fact a bug on the WordPress side.

It’s quite easy to reproduce, so here’s what I’ve done. On the blog we have a lot of authors. All those authors have the same role with the same capabilities: they MAY NOT publish posts directly (capability: publish_posts), but they MAY edit their own posts afterwards (capability: edit_published_posts). This last one seems to be causing the problem, here’s what happends:

When an author is writing a new post, and the post is saved (auto-save or manually) BEFORE pushing the “Submit for Review” button, the post is published directly, without getting the pending status. This only happens when the post is saved before submitting it.

At first I thought it was a bug in the Role Manager plugin we were using, but when I disable “edit_published_posts” this problem disappears and posts get the pending status even when it’s saved.

I think I fixed it now by hacking /wp-admin/includes/post.php right below line 71.

// START fix
if ('publish' == $_POST['post_status'] && !current_user_can( 'publish_posts' )) {
	$_POST['post_status'] = 'pending';
}
// END fix

But I really don’t like hacking. ?? So can anyone besides me confirm that this is in fact a WordPress bug?