Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have run into this problem where the following piece of code always returns true for any post ID supplied to it.

current_user_can('delete_posts', $post_id);

Normally, the above code should return false when the user is not the author of the post or does not have the capability to delete others post. However, it still returns true for any post ID.

The user has been assigned a custom role, as defined below.

$standard_role_capabilities = array ('read'                 => true,
                                    'delete_posts'              => true,
                                    'edit_posts'                => true,
                                    'delete_published_posts'    => true,
                                    'publish_posts'             => true,
                                    'edit_published_posts'      => true,
                                    'comment'                   => true
                            );

add_role('standard', 'Standard', $standard_role_capabilities);

Any reasons for this not working?

share|improve this question
    
You should accept your answer. It is funny, because I thought to look at whether it should be plural or not, because it seemed like it should be, and then I just decided that it must be right... –  Jake Aug 23 '12 at 16:16
    
@Jake I'd have to wait for 24hrs before I can accept my answer. Will do once 24hrs go by. –  John Aug 23 '12 at 18:13
add comment

3 Answers 3

up vote 2 down vote accepted

After hours of fighting to get this to work, it was just a matter of changing delete_posts to delete_post.

So, in it's entirety this would be:

current_user_can('delete_posts', $post_id);

to

current_user_can('delete_post', $post_id);

current_user_can does accept a second parameter. Though it's weird that the function declaration in capabilities.php does not define a second parameter as pointed out by @amit. May be someone can clarify why it is so.

share|improve this answer
1  
The reason that only the first parameter is documented is because the value of any other parameter(s) varies based on the capability being checked. As you can see, the other parameters provide context for the capability. For 'delete_post' the second parameter is the ID of the post. For other capabilities, it might be something different, or not used at all (as with 'delete_posts'). –  J.D. Apr 1 at 13:32
add comment

If you want to check if user can delete posts of other authors, you need to use proper capability - delete_others_posts.

share|improve this answer
    
Well, thx for the suggestion. However, this won't work. I need to check whether a particular post could be deleted by the current user. Not whether the user can delete others posts. –  John Aug 22 '12 at 14:16
    
This seems like your answer. You have given your user the abilty to delete all posts. If you want to give them the ability to only delete their own posts, you need to define that in their capabilities. You haven't done that. So define "delete_others_posts" => false in their capabilities, and then you can check the way you are currently and it will work. –  Jake Aug 23 '12 at 1:29
    
@Jake The user has only been given the capability to delete their own posts. User does not have the capability to delete_others_posts. BTW, got this working. Please see the answer I added. –  John Aug 23 '12 at 7:18
    
I see, the default is off, of course. I wasn't thinking right. Glad you got it working. –  Jake Aug 23 '12 at 16:15
add comment

EDIT -

There's another function author_can() Which'll accept post ID.

current_user_can() function accepts only one parameter, we can not pass the post id to it.

Parameters -

$capability
(string) (required) capability
Default: None

Example -

May be this is not the best way to achieve what you're looking for -
I guess in the below code, the if block will only get executed when current user is author of that post and has capability - delete_posts

<?php

    $current_user = wp_get_current_user();
    $author = get_the_author_meta('ID');

    if ( current_user_can('delete_posts') && ( $current_user->ID == $author ) ) {
        //  when current user is author with `delete_posts` capability
    }

?>

Update -

Allow user to delete his own posts but disallow deletion of others post.
If deletion is based on author of post then an administrator will not be able to delete the post even though the administrator has the privileges

Change the if statement to something like this -

    if ( current_user_can('activate_plugins') || ( $current_user->ID == $author ) ) 
    {
        //  when current user is author or admin
    }
share|improve this answer
1  
That's what I'd thought. However, looking at the edit_posts example on the Codex page (codex.wordpress.org/Function_Reference/current_user_can) for current_user_can I'd say it could accept the post ID as well. –  John Aug 22 '12 at 14:14
    
Ok, see my edit, I think you're looking for author_can() function. –  amit Aug 22 '12 at 14:18
    
author_can will not work. It checks whether the author of the post has a particular capability. Rather here I am looking whether a particular user can delete a given post. Two different things going in there. I hope it makes sense. –  John Aug 22 '12 at 14:23
    
If current user has cap to delete_posts then he can delete any post. So you want to prevent that user from deleting other users post ? –  amit Aug 22 '12 at 14:57
    
Yep! Exactly. Allow user to delete his own posts but disallow deletion of others post. This should be based on user's capability. Not on whether the user is the author of the post. If deletion is based on author of post then an administrator will not be able to delete the post even though the administrator has the privileges. –  John Aug 22 '12 at 17:26
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.