Hot answers tagged

16

Use Justin Tadlock's plugin "Members". It gives you the ability to create new roles and edit existing roles, as well as add custom capabilities. All that work that you'd have to do can be taken down to a few clicks. I know you said in your comment on ZaMoose's answer that you are 'looking to write the functionality myself so I have full control over ...


14

Codex - Register Post Type See the capability_type and capabilities arguments for register_post_type. You can pass the capabilities argument an array of capabilities to map to the necessary caps, here's an example of the args array with custom capabilities. $args = array( 'labels' => $labels, 'public' => true, 'publicly_queryable' => ...


13

For a plugin I'm currently working on, I wanted to grant/restrict access to the plugin settings (i.e., the according admin menu pages) on a per role base. Therefore, I had to add a new plugin-specific capability to the user roles. Unfortunately, kaiser's answer seems to be not working anymore, so I spent some time trying to figure out how to allow for the ...


12

The register post type has a parameter called "capabilities" so you can have for instance 'capability' => __('organize_shop'), http://codex.wordpress.org/Function_Reference/register_post_type To create a new user/role/capability you can use add_role, add_cap, for a simple example to get you started: add_role( 'shop_owner', 'Shop Owner', array( '...


10

Diff the post content, title and author As had to do something related some month ago, here's the easiest and most future proof way (that I could fine) to check if there's a change made to the content or title or if the author changed: // Update Title '' !== wp_text_diff( $el['post_title'], $GLOBALS['post']->post_title ) AND $GLOBALS['post']-...


8

Hi @NetConstructor: I think this is what you need. Note that I didn't include the full setup of your 'website_owner' role, just the addition of a new capability called 'manage_administrators'. Also, I only attempted to remove the "Delete" link from any users that don't have the 'manage_administrators' capability (which you'll need to add to the ...


8

Either of these 3 will help you: //Before getting the comments, on the WP_Comment_Query object for each comment add_action('pre_get_comments', 'wpse56652_filt_comm'); //Applied on the comments SQL Query, you can modify the 'Where' part of the query add_filter('comments_clauses', 'wpse56652_filt_comm'); //After the comments are fetched, you can modify the ...


8

I explored WordPress to find difference between it and in schema.php file i found the following function only where in WordPress add_users capability is used. /** * Create and modify WordPress roles for WordPress 3.0. * * @since 3.0.0 */ function populate_roles_300() { $role =& get_role( 'administrator' ); if ( !empty( $role ) ) { $role->...


8

I was sure that wp_update_user function should do this (http://codex.wordpress.org/Function_Reference/wp_update_user). It even gets user_login as param, but it looks like it ignores it, when you set this param. So this code looks OK, but it doesn't work as you wish it did :( : wp_update_user( array ( 'ID' => $user_id, 'user_login' => $new_login ) ) ;...


7

This isn't really a WordPress question - but you can add a rewrite rule to prevent access unless the referrer is your own domain. [Update] You'll need to do 2 things Add a rewrite rule (either directly with .htaccess or by using WP_rewrite (Codex reference). The aim here is to deny requests to your documents that don't have your domain as a referrer - ...


7

Remove what you add First, please make sure that everything you add on activation also gets removed on uninstall. I got a short tutorial including example code for you. Test with a small plugin: I really don't know much about MU, but as far as I can tell, the roles object is global across all blogs. Just try this little plugin and see what you can get: &...


7

Write this into a plugin: add_action( 'template_redirect', 'auth_redirect' ); As plugin on GitHub. This will force all visitors login if they aren’t already. In some cases, this is asking for a log-in every time. This might work better: add_action( 'template_redirect', function() { is_user_logged_in() || auth_redirect(); });


7

My idea is something simple. You can make an Edit Suggestion link at bottom of posts that has a custom defined template, in that use a textbox (maybe with an editor) that's linked to a custom taxonomy with the default value of post content. Any changes to content will be compared to original post content after submitting (as Draft) and Entering CAPTCHA ...


6

Hi @davemac: Well, I wrote this before I saw that you answered your own question so I might as well post it anyway: add_filter('list_terms_exclusions', 'yoursite_list_terms_exclusions', 10, 2); function yoursite_list_terms_exclusions( $exclusions, $args ) { global $pagenow; if (in_array($pagenow,array('post.php','post-new.php')) && !...


6

To let the current users only view his/her uploaded attachments, add the following code to your themes actions: add_filter( 'posts_where', 'devplus_wpquery_where' ); function devplus_wpquery_where( $where ){ global $current_user; if( is_user_logged_in() ){ // logged in user, but are we viewing the library? if( isset( $_POST['...


6

The user passwords are stored in one-way encription. Even looking at the database you can not know the password. The is a very basic privacy feature. Most users use the same password on multiple sites; imaging the potential risks for users if the administrator of the site can access to their passwords. You can intercept the password from the registration/...


5

As far as i know it should be possible to login with your email with wp 3.1, which will come soon. Using an email as username is already possible. "@" and "." are allowed characters for usernames. Hope that helps.


5

Use is_admin() to check if the the current page is an administration page. Despite its name this is not a user role check.


5

Use is_admin(). It checks if you're viewing an Admin page, means the backend.


5

This certainly can be done, but it requires some work. I am developing a pretty complex plugin for a client, and I plan to expand on it and make it available publicly when it is ready. Telling you everything would take ages, so I will just give you some pointers on how you can achieve what you are aiming for. Make a page called "Profile" and use a custom ...


5

In short - and for general use - yes. As @s_ha_dum pointed out though, it really depends on what you're using it for. Is the function secure? As @kaiser and @s_ha_dum have mentioned the function is pluggable - meaning that any plug-in (though not themes) can redefine it to do anything. But this isn't really a problem insofar as that plug-ins can do almost ...


5

admin_init runs on admin pages, not the front end. The equivalent front end action, init, is too early to check is_page. A safe action for redirection is template_redirect: function xyz() { if( is_page( 172 ) && ! current_user_can('update_core') ) { wp_redirect( home_url() ); exit; } } add_action( '...


4

Ok, after doing some more Googling I finally found an answer and combined it with one of the scripts above to create what I'm looking to do. Below is what i've done just in case someone else is looking to do the same: global $user_login; get_currentuserinfo(); if (!current_user_can('update_plugins')) { ..... } The above code will get the current users ...


4

there you go, i'm not the only one trying to bring back-end functionality to the front-end. anyway its not that hard go to your "USER DASHBOARD" template's file and locate where the loop starts something like: <?php if ( have_posts() ) : while ( have_posts() ) : the_post(); ?> and just above it paste this code: <?php /* First get the user info */...


4

You are way on the safer and less effort involved side if having them access the admin interface is an option. In that case you could implement a custom post type for your needs, disable most of the 'support' flags when registering it, and add your own metabox to support latitude and longitude, as well. With some extra plugins (like Members or any other ...


4

here's an example that hooks login_redirect and checks when their account was created, then redirects them to a url of your choice if it's been less than 48 hours: function my_redirect( $to, $requested, $user ){ if( !isset( $user->user_login ) ){ // we only want this to run when credentials have been supplied return $to; } $regtime = ...


4

What needs to happen is that you need to proxy download requests for the file types you want through WordPress. Let's assume you're going to restrict access to ".doc" files. 1. Define a query variable that indicates the requested file function add_get_file_query_var( $vars ) { $vars[] = 'get_file'; return $vars; } add_filter( 'query_vars', '...


4

I can suggest another method. First of all: grant full access to projects post type (Example). At the user profile add allowed posts' id. Then use below filter to restrict access if post id isn't allowed. function allow_user_to_edit_cpt_filter( $capauser, $capask, $param){ global $wpdb; $allowed_posts_id_for_current_user = array( '29', '30' ); /...


4

Role Scope is very powerful, but I think it's overkill for this. If you set Bob and Smith to have the role of Author (one of the default roles), they'll only be able to edit their own posts.


4

You can add this to your functions.php file in your template to allow the user to edit pages that they have created. Just specify their $user_id (i.e. 27): //to add capability to $user_id $user = new WP_User( $user_id ); $user->add_cap( 'edit_pages' ); $user->add_cap( 'edit_published_pages' ); You can find a specific user's $user_id from the URL ...



Only top voted, non community-wiki answers of a minimum length are eligible