Timeline for If the current user is an administrator or editor
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 31, 2021 at 6:56 | comment | added | gmazzap |
Regarding roles, yes, that's a public property you can rely on to be there, but current_user_can has filters, for example, developer.wordpress.org/reference/hooks/user_has_cap or developer.wordpress.org/reference/hooks/map_meta_cap. If a plugin or anything is using those filters to change what current_user_can returns, by directly checking roles property you're gonna miss the filters, and thus reducing the compatibility of your code with others code.
|
|
| Mar 31, 2021 at 6:47 | comment | added | gmazzap |
That said, asking the question "Is this user an editor?" might still be a legitimate question. You should not ask it to determine if a user is allowed or not to do anything, but you might ask that question for some other reason. And if that's the case, then current_user_can with role name is just fine.
|
|
| Mar 31, 2021 at 6:46 | comment | added | gmazzap | the documentation refers to the fact that, for example, an editor is usually able to edit posts. So you might be tempted to check for the user being an editor to allow editing a post. That is wrong because maybe the capability was filtered so that user despite being an editor should not edit the post. And it can be the other way around, a subscriber might be allowed to edit posts or that specific post only. Checking capability ensure those expected results are respected. | |
| Mar 18, 2021 at 19:32 | comment | added | sMyles |
@gmazzap then why would it specifically say "While checking against particular roles in place of a capability is supported in part, this practice is discouraged as it may produce unreliable results." on current_user_can documentation page. Seems the documentation and your comment are contradicting, although I do understand what you're saying. With that said though, $roles is a public property on WP_User object and has been since 2.0.0. developer.wordpress.org/reference/functions/current_user_can
|
|
| Mar 18, 2021 at 18:59 | comment | added | gmazzap |
Access low-level properties is never a good idea in WP, surely is not the correct way. If the question one is looking for an answer to is "Is the current user an editor?" then using current_user_can is perfectly fine, actually, that's exactly the way to go. The fact that is preferable to use capabilities to "protect" operations is a different topic. Knowing the role of a user might be a legitimate thing, and in that case, current_user_can is perfectly fine to use.
|
|
| Aug 26, 2019 at 18:21 | history | answered | sMyles | CC BY-SA 4.0 |