Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
<?php
if ( ! is_admin() ) return;
echo 'You should not see this if you\'re not logged in!';
?>

If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are not logged in, should you be able to see the echo?

share|improve this question
1  
There's an error (') in your code. –  amit Jan 14 '13 at 14:57
    
Should be the following: <?php if ( ! is_admin() ) return; echo "You should not see this if you're not logged in!"; ?> You need to use double quotes if you are going to include special characters inside the echo –  Fraggy Jan 14 '13 at 15:01
    
Thanks, error is fixed. –  akTed Jan 14 '13 at 15:12
    
You can use is_user_logged_in() to check if user is logged in or not –  amit Jan 14 '13 at 15:43
add comment

2 Answers 2

up vote 4 down vote accepted

You're misinterpreting the is_admin() function. It's not a tag to check whether or not the user is an admin, it's a template tag to check if you're on an admin page.

From the Codex:

This Conditional Tag checks if the Dashboard or the administration panel is being displayed. This is a boolean function, meaning it returns either TRUE or FALSE.

You're facing a couple of issued here though.

  1. If you attempt to go to /wp-admin while you're not logged in, WordPress will automatically redirect the page. A request to /wp-admin is really a request to /wp-admin/index.php, a page non-logged-in users don't have permission to see in the first place. So you'll be redirected to /wp-admin/wp-login.php which doesn't necessarily load your plugin code.
  2. I say "doesn't necessarily load your plugin code" because I'm not sure. From the looks of things you're echo/return exists in the global scope. Really, this code should be wrapped in a function and hooked to a WordPress action.

Now, if you go to the /wp-admin page while you're logged in, is_admin() will evaluate to true you should be able to see the content of your echo statement just fine, assuming a couple of things:

  1. No errors in your code (as both @amit and @Fraggy have pointed out, you have a typo - an unescaped ' character.
  2. That you're hooking things in at the right place. You shouldn't just echo and return in the global scope because, really, there's no way to control where that echo/return will be happening. You should place this code in a function.

Important Note

If you ever do find a security hole or security-related bug in WordPress, you should report it to security@wordpress.org rather than posting in a public forum like this. This kind of responsible disclosure gives the team the chance to address and patch the issue before malicious hackers can read about it and exploit it.

share|improve this answer
    
Thanks for the info. I'm aware that I need to hook in the right places, and test user capabilities. But the Codex is somewhat misleading in it's assertion Dashboard or the administration panel is being displayed. WP redirected me to login page once out of about ten times that I tried this. All other times showed the echo. Re: your note about reporting, I agree and normally wouldn't throw something out willy-nilly; I wanted to get guidance on this before posting to Trac. I didn't want to look stupid with something that is possibly a misunderstanding on my part. –  akTed Jan 14 '13 at 15:35
    
One more note, I wasn't assuming that is_admin() meant Administrator. I was assuming it meant what the Codex said, the part in your quote: Dashboard or the administration panel is being displayed. –  akTed Jan 14 '13 at 15:39
    
Yes, and index.php is the Dashboard. But if you're not logged in, you should be redirected to wp-login.php, which is not the Dashboard or an administrative panel. –  EAMann Jan 14 '13 at 15:56
    
Should be redirected. But that is not the case. :( –  akTed Jan 14 '13 at 16:10
    
If you're not being redirected to the login page when you're not logged in, then something else is going on. Either due to this plugin or another you have on the site. In either case, that's beyond the scope of this particular question. Perhaps open a new one - "Why are not-logged in users failing to be redirected to wp-login.php?" –  EAMann Jan 14 '13 at 16:14
show 2 more comments

The is_admin() only checks for if current visitor is on admin page or not.

To block any non admin user from visting any admin page use current_user_can(); function. Here's an example to check if current user is not a admin.

if ( ! current_user_can( 'manage_options' ) ) {
    echo 'You should not see this if you\'re not logged in!';
}

#1 Update -

is_user_logged_in() - There's a function to check if current visiting user is logged in or not, You can use that. Here's an updated example -

if ( ! is_user_logged_in() ) {
   echo 'You should not see this if you\'re not logged in';
}
share|improve this answer
    
But, according to is_admin() in the Codex "This Conditional Tag checks if the Dashboard or the administration panel is being displayed" –  akTed Jan 14 '13 at 15:16
    
refer to other answer by @EAMann to know more about is_admin() –  amit Jan 14 '13 at 15:17
    
@AKTed yep, is_admin() checks for current page type not the visiting user's. –  amit Jan 14 '13 at 15:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.