<?php
if ( ! is_admin() ) return;
echo 'You should not see this if you\'re not logged in!';
?>
If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/
while you are not logged in, should you be able to see the echo
?
<?php
if ( ! is_admin() ) return;
echo 'You should not see this if you\'re not logged in!';
?>
If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/
while you are not logged in, should you be able to see the echo
?
You're misinterpreting the is_admin()
function. It's not a tag to check whether or not the user is an admin, it's a template tag to check if you're on an admin page.
From the Codex:
This Conditional Tag checks if the Dashboard or the administration panel is being displayed. This is a boolean function, meaning it returns either TRUE or FALSE.
You're facing a couple of issued here though.
/wp-admin
while you're not logged in, WordPress will automatically redirect the page. A request to /wp-admin
is really a request to /wp-admin/index.php
, a page non-logged-in users don't have permission to see in the first place. So you'll be redirected to /wp-admin/wp-login.php
which doesn't necessarily load your plugin code.echo
/return
exists in the global scope. Really, this code should be wrapped in a function and hooked to a WordPress action.Now, if you go to the /wp-admin
page while you're logged in, is_admin()
will evaluate to true
you should be able to see the content of your echo
statement just fine, assuming a couple of things:
'
character.echo
and return
in the global scope because, really, there's no way to control where that echo
/return
will be happening. You should place this code in a function.If you ever do find a security hole or security-related bug in WordPress, you should report it to [email protected] rather than posting in a public forum like this. This kind of responsible disclosure gives the team the chance to address and patch the issue before malicious hackers can read about it and exploit it.
is_admin()
meant Administrator. I was assuming it meant what the Codex said, the part in your quote: Dashboard or the administration panel is being displayed.
index.php
is the Dashboard. But if you're not logged in, you should be redirected to wp-login.php
, which is not the Dashboard or an administrative panel.
The
is_admin()
only checks for if current visitor is on admin page or not.
To block any non admin user from visting any admin page use current_user_can();
function. Here's an example to check if current user is not a admin.
if ( ! current_user_can( 'manage_options' ) ) {
echo 'You should not see this if you\'re not logged in!';
}
#1 Update -
is_user_logged_in()
- There's a function to check if current visiting user is logged in or not, You can use that. Here's an updated example -if ( ! is_user_logged_in() ) { echo 'You should not see this if you\'re not logged in'; }
is_admin()
checks for current page type not the visiting user's.
Jan 14, 2013 at 15:20
<?php if ( ! is_admin() ) return; echo "You should not see this if you're not logged in!"; ?>
You need to use double quotes if you are going to include special characters inside the echois_user_logged_in()
to check if user is logged in or not