Tag Info

Hot answers tagged

10

Codex - Register Post Type See the capability_type and capabilities arguments for register_post_type. You can pass the capabilities argument an array of capabilities to map to the necessary caps, here's an example of the args array with custom capabilities. $args = array( 'labels' => $labels, 'public' => true, 'publicly_queryable' => ...


10

Use Justin Tadlock's plugin "Members". It gives you the ability to create new roles and edit existing roles, as well as add custom capabilities. All that work that you'd have to do can be taken down to a few clicks. I know you said in your comment on ZaMoose's answer that you are 'looking to write the functionality myself so I have full control over ...


9

Diff the post content, title and author As had to do something related some month ago, here's the easiest and most future proof way (that I could fine) to check if there's a change made to the content or title or if the author changed: // Update Title '' !== wp_text_diff( $el['post_title'], $GLOBALS['post']->post_title ) AND ...


8

Hi @NetConstructor: I think this is what you need. Note that I didn't include the full setup of your 'website_owner' role, just the addition of a new capability called 'manage_administrators'. Also, I only attempted to remove the "Delete" link from any users that don't have the 'manage_administrators' capability (which you'll need to add to the ...


7

This isn't really a WordPress question - but you can add a rewrite rule to prevent access unless the referrer is your own domain. [Update] You'll need to do 2 things Add a rewrite rule (either directly with .htaccess or by using WP_rewrite (Codex reference). The aim here is to deny requests to your documents that don't have your domain as a referrer - ...


7

Either of these 3 will help you: //Before getting the comments, on the WP_Comment_Query object for each comment add_action('pre_get_comments', 'wpse56652_filt_comm'); //Applied on the comments SQL Query, you can modify the 'Where' part of the query add_filter('comments_clauses', 'wpse56652_filt_comm'); //After the comments are fetched, you can modify the ...


7

My idea is something simple. You can make an Edit Suggestion link at bottom of posts that has a custom defined template, in that use a textbox (maybe with an editor) that's linked to a custom taxonomy with the default value of post content. Any changes to content will be compared to original post content after submitting (as Draft) and Entering CAPTCHA ...


6

Write this into a plugin: add_action( 'template_redirect', 'auth_redirect' ); As plugin on GitHub. This will force all visitors login if they aren’t already. In some cases, this is asking for a log-in every time. This might work better: add_action( 'template_redirect', function() { is_user_logged_in() || auth_redirect(); });


6

I explored WordPress to find difference between it and in schema.php file i found the following function only where in WordPress add_users capability is used. /** * Create and modify WordPress roles for WordPress 3.0. * * @since 3.0.0 */ function populate_roles_300() { $role =& get_role( 'administrator' ); if ( !empty( $role ) ) { ...


5

Hi @davemac: Well, I wrote this before I saw that you answered your own question so I might as well post it anyway: add_filter('list_terms_exclusions', 'yoursite_list_terms_exclusions', 10, 2); function yoursite_list_terms_exclusions( $exclusions, $args ) { global $pagenow; if (in_array($pagenow,array('post.php','post-new.php')) && ...


5

The register post type has a parameter called "capabilities" so you can have for instance 'capability' => __('organize_shop'), http://codex.wordpress.org/Function_Reference/register_post_type To create a new user/role/capability you can use add_role, add_cap, for a simple example to get you started: add_role( 'shop_owner', 'Shop Owner', array( ...


5

Remove what you add First, please make sure that everything you add on activation also gets removed on uninstall. I got a short tutorial including example code for you. Test with a small plugin: I really don't know much about MU, but as far as I can tell, the roles object is global across all blogs. Just try this little plugin and see what you can get: ...


5

For a plugin I'm currently working on, I wanted to grant/restrict access to the plugin settings (i.e., the according admin menu pages) on a per role base. Therefore, I had to add a new plugin-specific capability to the user roles. Unfortunately, kaiser's answer seems to be not working anymore, so I spent some time trying to figure out how to allow for the ...


5

To let the current users only view his/her uploaded attachments, add the following code to your themes actions: add_filter( 'posts_where', 'devplus_wpquery_where' ); function devplus_wpquery_where( $where ){ global $current_user; if( is_user_logged_in() ){ // logged in user, but ware we viewing the library? if( isset( ...


5

In short - and for general use - yes. As @s_ha_dum pointed out though, it really depends on what you're using it for. Is the function secure? As @kaiser and @s_ha_dum have mentioned the function is pluggable - meaning that any plug-in (though not themes) can redefine it to do anything. But this isn't really a problem insofar as that plug-ins can do almost ...


5

admin_init runs on admin pages, not the front end. The equivalent front end action, init, is too early to check is_page. A safe action for redirection is template_redirect: function xyz() { if( is_page( 172 ) && ! current_user_can('update_core') ) { wp_redirect( home_url() ); exit; } } add_action( ...


4

Well, you have to ask yourself "Secure enough for what?" I doubt you are a bank or other institution that needs exceptionally high security. If you were you'd a team of $100,000+ per year experts to answer this question for you. With that in mind... You'd have to subvert the WordPress login system to get past that code. I am sure that is possible but if ...


4

Pluggable functions First off, pluggables are loaded from within the ~/wp-settings.php file. They are included after all plug-in files have been included (but before plugins_loaded) so any plugin can replace them. (mu-plugins are included even earlier, so they take precedence). Obstacles for a hack The default user will never worry about this, as (s)he ...


4

Well this is rather complicated, a proper answer would take considerable time to write. So this isn't a real answer just some thoughts.. Using WordPress build in wp_update_post via ajax would give you the needed revision history but not the capability needed to approve edits. Creating drafts from edits is not possible by default but has been discussed ...


4

This certainly can be done, but it requires some work. I am developing a pretty complex plugin for a client, and I plan to expand on it and make it available publicly when it is ready. Telling you everything would take ages, so I will just give you some pointers on how you can achieve what you are aiming for. Make a page called "Profile" and use a custom ...


4

Use is_admin() to check if the the current page is an administration page. Despite its name this is not a user role check.


4

Simple answer is yes you can. :) First check out Wordpress's codex here on their RSS feeds. http://codex.wordpress.org/WordPress_Feeds Then what you can do is change the default head rss links that let browsers know that there is an RSS feed. In your theme find: <link rel="alternate" type="application/rss+xml" title="RSS 2.0" href="<?php bloginfo ...


4

here's an example that hooks login_redirect and checks when their account was created, then redirects them to a url of your choice if it's been less than 48 hours: function my_redirect( $to, $requested, $user ){ if( !isset( $user->user_login ) ){ // we only want this to run when credentials have been supplied return $to; } $regtime = ...


4

You are way on the safer and less effort involved side if having them access the admin interface is an option. In that case you could implement a custom post type for your needs, disable most of the 'support' flags when registering it, and add your own metabox to support latitude and longitude, as well. With some extra plugins (like Members or any other ...


4

there you go, i'm not the only one trying to bring back-end functionality to the front-end. anyway its not that hard go to your "USER DASHBOARD" template's file and locate where the loop starts something like: <?php if ( have_posts() ) : while ( have_posts() ) : the_post(); ?> and just above it paste this code: <?php /* First get the user info ...


3

Ok, after doing some more Googling I finally found an answer and combined it with one of the scripts above to create what I'm looking to do. Below is what i've done just in case someone else is looking to do the same: global $user_login; get_currentuserinfo(); if (!current_user_can('update_plugins')) { ..... } The above code will get the current users ...


3

This plugin says it is possible http://wordpress.org/extend/plugins/wp-email-login/ It Lets you use your email address to log into your WordPress account instead of a username.


3

As far as i know it should be possible to login with your email with wp 3.1, which will come soon. Using an email as username is already possible. "@" and "." are allowed characters for usernames. Hope that helps.


3

I can suggest another method. First of all: grant full access to projects post type (Example). At the user profile add allowed posts' id. Then use below filter to restrict access if post id isn't allowed. function allow_user_to_edit_cpt_filter( $capauser, $capask, $param){ global $wpdb; $allowed_posts_id_for_current_user = array( '29', '30' ); ...


3

Justin Tadlocks Members Plugin is a great start. Create a new role and give them the permission of moderate_comments and you should be good to go.



Only top voted, non community-wiki answers of a minimum length are eligible