Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Did some research, but I was unable to implement it after all.

I have a custom post type accessible only by a new role. I want to filter the post type listing so that each user should see only his records (as Author users can see their posts only). I've tried to filter parse_query but it works for the main listing only (still I can see other records).

Which is the correct filter to use in order to prevent malicious users to list others' records?

Tried with pre_get_posts as well, but still I can see other users' posts.

Which is the correct filter to use for general separation of post objects per user?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

pre_get_posts is correct.

the code from will prevent any non-admin from seeing anyone else's posts.

http://blog.rutwick.com/display-only-the-posts-authored-by-the-current-wp-user-on-the-posts-page-in-the-back-end

to limit that to only 1 post type you'd add in one more condition and check $typenow == 'your_custom_post_type':

add_action('pre_get_posts', 'filter_posts_list');
function filter_posts_list($query)
{
    //$pagenow holds the name of the current page being viewed
     global $pagenow, $typenow;  

    //$current_user uses the get_currentuserinfo() method to get the currently logged in user's data
     global $current_user;
     get_currentuserinfo();

        //Shouldn't happen for the admin, but for any role with the edit_posts capability and only on the posts list page, that is edit.php
        if(!current_user_can('administrator') && current_user_can('edit_posts') && ('edit.php' == $pagenow) &&  $typenow == 'your_custom_post_type')
     { 
        //global $query's set() method for setting the author as the current user's id
        $query->set('author', $current_user->ID);
        }
}
share|improve this answer
    
I'm definitely going to try this one, however even when I tried the same snippet disregarding the pagenow/typenow and checking for the current page, it didn't work. So any chance that the filter works only when checking the specific pages? –  Mario Peshev Jan 12 '12 at 20:13
    
helga, seems like the second portion of the link you sent is what I actually need - filters for the views don't work here and that's the problem. Big time thanks. They are hidden now, but I can still access them via URL - even though restricting 3 out of the 7 permissions for the custom post type.Any tips here? –  Mario Peshev Jan 12 '12 at 20:17
    
i tested this locally on wp 3.3.1 and when i log in as an author i can't see any other posts in the edit.php screens. so it would seem to do exactly what it claims. what are you experiencing instead? you can edit your post to include code. –  helgatheviking Jan 12 '12 at 20:48
    
the same case, but with a custom post type –  Mario Peshev Jan 13 '12 at 22:02
    
no idea what you mean by 'the same case' and you haven't added any code. not sure you can do much if the author/user is adding query vars in the URL bar. –  helgatheviking Jan 13 '12 at 22:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.