The issue is that an empty return value from map_meta_cap
will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page
to the existing list of required capabilities:
add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
if ( 'edit_post' === $cap || 'edit_page' === $cap ) {
$current_page_id = $args[0];
$special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;
// If the page being edited is the special page...
if ( $special_page_id === $current_page_id ) {
// ... the user must have the edit_special_page capability.
$caps[] = 'edit_special_page';
}
}
return $caps;
}, 10, 4 );
An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init
or init
. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation or when the user is registered:
add_action( 'user_register', function( $user_id ) {
$user = get_userdata( $user_id );
if ( strpos( $user->user_login, '@special-domain.com' ) !== false ) {
$user->add_cap( 'edit_special_page' );
}
} );