0

I want to restrict dashboard access for users with a custom user role.

The code works fine, and i can perform custom ajax requests successfully, howeverim not able to upload a file using the wp.media uploader.

This is my restriction code

add_action('admin_init', 'no_mo_dashboard');
function no_mo_dashboard() {
    if (!current_user_can('custom_role') && !(defined('DOING_AJAX') && DOING_AJAX)) {
        wp_redirect(home_url()); 
        exit;
    }
}

It would seem as if the wp.media uploader is uploading the file via ajax, however the above statement doesn't allow for it (i guess DOING_AJAX isn't set?)

Below is my upload code

jQuery(document).ready(function($){

    var custom_uploader;

    $('#upload_image_button').click(function(e) {

        e.preventDefault();

        //If the uploader object has already been created, reopen the dialog
        if (custom_uploader) {
            custom_uploader.open();
            return;
        }

        //Extend the wp.media object
        custom_uploader = wp.media.frames.file_frame = wp.media({
            title: 'Choose Image',
            button: {
                text: 'Choose Image'
            },
            multiple: false,
            library : {
                type : false,
            },
        });

        $this = $(this);
        //When a file is selected, grab the URL and set it as the text field's value
        custom_uploader.on('select', function() {
            attachment = custom_uploader.state().get('selection').first().toJSON();
            $('.uploaded_image .circle_avatar').css("background-image", "url("+attachment.sizes.apcc_avatar.url+")");

        });

        //Open the uploader dialog
        custom_uploader.open();

    });


});

Any ideas where i'm going wrong here?

Cheers guys!

EDIT

Interestingly, the following code works

if (!current_user_can('custom_role') && !(defined('DOING_AJAX') && DOING_AJAX) && count($_POST) == 0) {
        wp_redirect(home_url()); 
        exit;
    }

However i can see the potential security risks here (someone could post a form to an admin page themselves and gain access)

  • First of all, what is custom_role? Is it a role? You shouldn't put a role in current_user_can (it's not guaranteed to work correctly). You want to allow or disallow custom_role to access wp-admin? – Krzysiek Dróżdż Dec 3 '13 at 17:40
  • Custom role is a role i created (i've changed the name to put it on here) I want to disallow any one with out that role. This works as i want it to, just not with ajax uploads on front of site – user195257 Dec 4 '13 at 9:12
  • After Codex: "Do not pass a role name to current_user_can(), as this is not guaranteed to work correctly (see #22624). Instead, you may wish to try the check user role function put together by AppThemes." – Krzysiek Dróżdż Dec 4 '13 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.