Skip to main content
edited body
Source Link
Jacob Peattie
  • 43.9k
  • 10
  • 49
  • 62

The issue is that an empty return value from map_meta_cap will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page to the existing list of required capabilities:

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
    if ( 'edit_post' === $cap || 'edit_page' === $cap ) {
        $current_page_id = $args[0];
        $special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;

        // If the page being edited is the special page...
        if ( $special_page_id === $current_page_id ) {
            // ... the user must have the edit_special_page capability.
            $caps[] = 'edit_special_page';
        }
    }

    return $caps;
}, 10, 4 );

An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init or init. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation or when the user is registered:

add_action( 'user_register', function( $user_id ) {
    $user = get_userdata( $user_id );

    if ( strpos( $user->user_login, '@special-domain.com' ) !== false ) {
        $user->add_cap( 'edit_special_page' );
    }
} );

The issue is that an empty return value from map_meta_cap will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page to the existing list of required capabilities:

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
    if ( 'edit_page' === $cap ) {
        $current_page_id = $args[0];
        $special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;

        // If the page being edited is the special page...
        if ( $special_page_id === $current_page_id ) {
            // ... the user must have the edit_special_page capability.
            $caps[] = 'edit_special_page';
        }
    }

    return $caps;
}, 10, 4 );

An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init or init. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation or when the user is registered:

add_action( 'user_register', function( $user_id ) {
    $user = get_userdata( $user_id );

    if ( strpos( $user->user_login, '@special-domain.com' ) !== false ) {
        $user->add_cap( 'edit_special_page' );
    }
} );

The issue is that an empty return value from map_meta_cap will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page to the existing list of required capabilities:

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
    if ( 'edit_post' === $cap || 'edit_page' === $cap ) {
        $current_page_id = $args[0];
        $special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;

        // If the page being edited is the special page...
        if ( $special_page_id === $current_page_id ) {
            // ... the user must have the edit_special_page capability.
            $caps[] = 'edit_special_page';
        }
    }

    return $caps;
}, 10, 4 );

An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init or init. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation or when the user is registered:

add_action( 'user_register', function( $user_id ) {
    $user = get_userdata( $user_id );

    if ( strpos( $user->user_login, '@special-domain.com' ) !== false ) {
        $user->add_cap( 'edit_special_page' );
    }
} );
added 276 characters in body
Source Link
Jacob Peattie
  • 43.9k
  • 10
  • 49
  • 62

The issue is that an empty return value from map_meta_cap will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page to the existing list of required capabilities:

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
    if ( 'edit_page' === $cap ) {
        $current_page_id = $args[0];
        $special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;

        // If the page being edited is the special page...
        if ( $special_page_id === $current_page_id ) {
            // ... the user must have the edit_special_page capability.
            $caps[] = 'edit_special_page';
        }
    }

    return $caps;
}, 10, 4 );

An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init or init. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation. or when the user is registered:

add_action( 'user_register', function( $user_id ) {
    $user = get_userdata( $user_id );

    if ( strpos( $user->user_login, '@special-domain.com' ) !== false ) {
        $user->add_cap( 'edit_special_page' );
    }
} );

The issue is that an empty return value from map_meta_cap will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page to the existing list of required capabilities:

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
    if ( 'edit_page' === $cap ) {
        $current_page_id = $args[0];
        $special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;

        // If the page being edited is the special page...
        if ( $special_page_id === $current_page_id ) {
            // ... the user must have the edit_special_page capability.
            $caps[] = 'edit_special_page';
        }
    }

    return $caps;
}, 10, 4 );

An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init or init. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation.

The issue is that an empty return value from map_meta_cap will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page to the existing list of required capabilities:

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
    if ( 'edit_page' === $cap ) {
        $current_page_id = $args[0];
        $special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;

        // If the page being edited is the special page...
        if ( $special_page_id === $current_page_id ) {
            // ... the user must have the edit_special_page capability.
            $caps[] = 'edit_special_page';
        }
    }

    return $caps;
}, 10, 4 );

An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init or init. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation or when the user is registered:

add_action( 'user_register', function( $user_id ) {
    $user = get_userdata( $user_id );

    if ( strpos( $user->user_login, '@special-domain.com' ) !== false ) {
        $user->add_cap( 'edit_special_page' );
    }
} );
Source Link
Jacob Peattie
  • 43.9k
  • 10
  • 49
  • 62

The issue is that an empty return value from map_meta_cap will grant all users permission to do that thing, because that's essentially the same thing as saying "no capabilities are required to do this". What you really want to do is just add edit_special_page to the existing list of required capabilities:

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
    if ( 'edit_page' === $cap ) {
        $current_page_id = $args[0];
        $special_page_id = get_page_by_path( 'special-page' ) ? get_page_by_path( 'special-page' )->ID : null;

        // If the page being edited is the special page...
        if ( $special_page_id === $current_page_id ) {
            // ... the user must have the edit_special_page capability.
            $caps[] = 'edit_special_page';
        }
    }

    return $caps;
}, 10, 4 );

An unrelated issue, but something that you'll need to address, is that you shouldn't add capabilities on admin_init or init. Adding capabilities writes to the database, so its only something that should be done once of plugin/theme activation.