Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

What is the capability that let users to edit their own posts and not others? I am trying to enable the post authors to avail a plugin function only on the posts they own.

The permission to access the option should be only to that particular post authors and even the editors shouldn't have access. Next to the post authors, only the administrator should have the access.

The plugin's code has:

function init()
{
    // must be logged in
    if( is_user_logged_in() )
    {
        // actions
        add_action('admin_head', array($this,'admin_head'));
        add_action('admin_menu', array($this,'admin_menu'));


        add_action('wp_enqueue_scripts', array($this,'wp_enqueue_scripts'));
        add_action('wp_head', array($this,'wp_head'));
        add_action('wp_footer', array($this,'wp_footer'));
        add_action('wp_ajax_live_edit_update_width', array($this, 'ajax_update_width'));
    }
}

I have edited the plugin file to change the capabilities(line 79).

    function init()
    {
        // must be logged in
if( is_user_logged_in() && current_user_can('author') || current_user_can('administrator'))
        {
            // actions
            add_action('admin_head', array($this,'admin_head'));
            add_action('admin_menu', array($this,'admin_menu'));


            add_action('wp_enqueue_scripts', array($this,'wp_enqueue_scripts'));
            add_action('wp_head', array($this,'wp_head'));
            add_action('wp_footer', array($this,'wp_footer'));
            add_action('wp_ajax_live_edit_update_width', array($this, 'ajax_update_width'));
        }
    }

Now, only the post authors and administrators have access to it. But I want to replace current_user_can('author') to a capability which lets the author's to edit their own post and not others. The capabilities like edit_posts or edit_published_posts gives access to all the posts.

Could any one tell me about a capability which enable users to edit their own posts and not others? Also let me know if the way I used is right. if( is_user_logged_in() && current_user_can('author') || current_user_can('administrator'))

Here is the plugin's code: http://pastebin.com/m1E9QthM. Link to the original plugin is- http://wordpress.org/support/plugin/live-edit

share|improve this question
1  
This looks to be very closely related to your other question-- dangerously close to a duplicate. –  s_ha_dum Dec 11 '13 at 15:11

3 Answers 3

An author is someone who can publish and manage their own posts. Perhaps taking a look here in the codex at Roles and Capabilities will help, it tells you all the roles WordPress has and the different capabilities.

If you're going to mix and match capabilities, then maybe what you need to do is create a new role with add_role().

share|improve this answer

You can check the permission to edit a special post with the meta capability edit_post by passing the post ID as the second argument to function current_user_can():

current_user_can( 'edit_post', $post_ID )

This evaluates to the capability edit_posts if the post_author field of this post matches the current users ID. For more details on how that works see the code of the function map_meta_cap() in wp-includes/capabilities.php around the line 1073.

Edit: For what is see in your plugin, you can check for is_singular() and getting the ID by get_the_ID() to apply your plugin functionality conditionally. But the init hook is to early for that. Use the wp hook instead. With this you can apply your scrips for singular queries (pages, posts, …) for example. Don't forget to check the meta cap anytime you save a post (for example in ajax callbacks.)

share|improve this answer
    
Hello @david , I have updated the code with this capability and has no luck with it. My knowledge with php is limited and don't know how to proceed further. Here is the new edited code- pastebin.com/isFdduBg . Can you guide me through how to proceed further? –  IamSJ Dec 12 '13 at 5:59
    
I'll try it, @lamSJ. But i think this is not the right place to audit and discuss your whole plugin source. It's much more than about the question of how to check edit permissions on a single post. Either you move your source to e.g. github.com or gist.github.com and we discuss details over there (and link it here) or i explain an example in my answer above. I'm not sure what is the best way in the WPSE philosophy… –  David Dec 12 '13 at 9:51
    
Hello @David, I have created a Gist and here is the link- gist.github.com/sjeev/7926153 (Link to the Elliot's plugin is- wordpress.org/support/plugin/live-edit). Thanks for helping me! –  IamSJ Dec 12 '13 at 10:50

You can get_post(), check if the get_current_user_id equals the post_author information, and then act upon that...

if ('edit.php' === $GLOBALS['pagenow']) {
    if (
        current_user_can('administrator')
        || get_post(filter_input(INPUT_POST, 'post_id'))->post_author == get_current_user_id()
    ) {
        // Yes, you can
    } else {
        wp_redirect(admin_url());
        exit;
    }
}
share|improve this answer
    
Hello @t-f , do I need to replace YOUR-ID-Here with a particular post Id? If so, how can I make that work for all the posts? –  IamSJ Dec 11 '13 at 16:47
    
@IamSJ Please see my edited answer. There are several ways to restrict a user from editing a post. The question is, where you want to step in, and how you want to handle the issue. In my updated answer I just redirect a user, who should not edit a post (i.e., the user is neither an administrator nor the post author). –  t f Dec 18 '13 at 21:51
    
Hello @t-f, I have edited the code as you suggested. I have replaced if( is_user_logged_in() && current_user_can('author') || current_user_can('administrator')) with your code. After editing the code, I see these changes: 1) the users(authors) lost access to the posts section on dashboard(also unable to access their own posts on dashboard). 2) the live-edit's "edit" button is still accessible by the authors on all posts. Can you tell me if I am done something wrong here or missed something? –  IamSJ Dec 19 '13 at 13:40
    
Hello @t-f, I have edited the code as you suggested. I have replaced if( is_user_logged_in() && current_user_can('author') || current_user_can('administrator')) with your code. I would like to update with the new findings. And I think we are much nearer to the goal. Will post them in a new comment. –  IamSJ Dec 19 '13 at 13:52
    
These are the changes I found 1) the users(authors) lost access to the posts section on dashboard. Also unable to view/access the posts lists on dashboard. But can access and edit the posts by clicking the native WordPress edit button on individual posts. Ofcourse, that is not a big problem. 2) The authors are able to access the live-edit's "edit" button on all the posts other than the posts they own. What I needed is that they should access the button on their own posts and not others. –  IamSJ Dec 19 '13 at 13:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.