How can I hide media library images from general users?

Question

As an admin I really like the features and functionality of the WordPress 3.5 media manager.

With a multi-user site however all users can see all images in the media library - whether uploaded by them or not. Previously a functions.php script could mask / restrict access.
For example:

// Hide Media Library tab Tab from each individual agent
function remove_medialibrary_tab($tabs) {
    if ( !current_user_can( 'update_core' ) ) {
        unset($tabs['library']);
        return $tabs;
    }    }
add_filter('media_upload_tabs','remove_medialibrary_tab');

This no longer works as I believe the media library is now JavaScript based.

The question: how can I now hide or mask the WordPress 3.5 media library images from users that did not upload the images in the library? I want users to only see their own images or to only see the images they uploaded to this specific post or page.

The current structure and design is great for the likes of a newspaper that wants to share images across their entire organization of users - but not so good for sites that have needs for stricter controls with independent multi-user access.

I am not a coder - or am an amateur at best - but it occurs to me that options might include: masking or coding out all attachment filters in the new 3.5 library dropdown menu only leaving the "uploaded to this page" in the list - or - possibly a switch that would allow admins to switch visibility on or off to the media library images for general users.

Any guidance or direction on this would be appreciated.

Answer 1

To let the current users only view his/her uploaded attachments, add the following code to your themes actions:

add_filter( 'posts_where', 'devplus_wpquery_where' );
function devplus_wpquery_where( $where ){
    global $current_user;

    if( is_user_logged_in() ){
         // logged in user, but are we viewing the library?
         if( isset( $_POST['action'] ) && ( $_POST['action'] == 'query-attachments' ) ){
            // here you can add some extra logic if you'd want to.
            $where .= ' AND post_author='.$current_user->data->ID;
        }
    }

    return $where;
}

Hope this helps!

Answer 2

Thanks @timocouckuyt, that works fine but you also need this one for the /wp-admin/upload.php link :

add_filter('pre_get_posts', 'hide_posts_media_by_other');
function hide_posts_media_by_other($query) {
global $pagenow;

if( 'upload.php' != $pagenow || !$query->is_admin ){
    return $query;
}

if( !current_user_can( 'manage_options' ) ) {
    global $user_ID;
    $query->set('author', $user_ID );
}
return $query;
}

For complete tutorial to hide media and posts from other users please check this tutorial : http://jeffreycarandang.com/tutorials/hide-wordpress-posts-media-uploaded-users/

Cheers, phpbits

Answer 3

source reference: https://www.wpexplorer.com/disable-image-page/

Redirect Via Custom Function

<?php
// Hide attachments from being view on frontend by redirecting users
function hide_my_attachments_by_redirecting() {
    if ( is_attachment() ) {
        global $post;
        if ( $post && $post->post_parent ) {
            wp_redirect( esc_url( get_permalink( $post->post_parent ) ), 301 );
            exit;
        } else {
            wp_redirect( esc_url( home_url( '/' ) ), 301 );
            exit;
        }
    }
}
add_action( 'template_redirect', 'hide_my_attachments_by_redirecting' );

OR

Redirect Via The image.php File

Your second option is to completely disable your attachment pages by adding a WordPress redirect directly added to the top of your image.php file.

1. Create a new file called image.php in your child theme (always best to work with child theme’s when editing a theme) or if you are developing your own theme create an empty image.php file in your theme.
2. Insert the code below in your image.php file.

<?php
global $post;
if ( $post && $post->post_parent ) {
    wp_redirect( esc_url( get_permalink( $post->post_parent ) ), 301 );
    exit;
} else {
    wp_redirect( esc_url( home_url( '/' ) ), 301 );
    exit;
}