Prevent user from editing others posts

Question

I have declared a new post type and it is visible on the admin menu: function create_post_type() {

    register_post_type( 'employer_fm',
      array(
        'labels' => array(
      'name' => _x('Employer', 'Employers'),
      'singular_name' => _x('Employer ', 'domain'),
    ),
        'public' => true, 
        'capability_type'    => array('employer','employers','adminstrator'),

        'supports' => array('title','author','thumbnail','page-attributes'),
        'capabilities' => array(
              'read_post' => 'read_employer',
              'publish_posts' => 'publish_employer',
              'edit_posts' => 'edit_employers',
              'edit_others_posts' => 'edit_others_employer',
              'delete_posts' => 'delete_employer',
              'delete_others_posts' => 'delete_others_employer',
              'edit_others_pages' => 'edit_others_employer_page',
              'read_private_posts' => 'read_private_employer',
              'edit_post' => 'edit_employer',
              'delete_post' => 'delete_employer',
             ),
      )
    );
  }

I have also declared roles:

$result = add_role(
        'employer',
        __( 'Employer' ),
        array( 
            'edit_employer'   => true,
            'edit_employers' => true,
            'publish_employer' => true,
            'read_employer' => true,
            'delete_employer'=> true,
            'edit_others_employer' => false,
            'delete_others_employer' => false,
            'edit_others_employer_page' => false
        )
    ); 
     $role = get_role( 'administrator' );
     $role->add_cap( 'edit_employer' ); 
     $role->add_cap( 'read_employer' ); 
     $role->add_cap( 'delete_employer' ); 
     $role->add_cap( 'edit_employers' ); 
     $role->add_cap( 'publish_employer' ); 

if 'map_meta_cap' => true, Users can only view and publish posts (including admin) and if it it not set all users can edit all employer type posts.

How can I prevent employer user types from editing others posts?

Answer 1

A possibility is, that you add via plugin a filter, there check the rights and only users with his User ID in each post can change this posts.

The follow example doing this, but you must enhance a check for your custom post type, if you will only allow this on your CPT.

/**
 * Plugin Name: Display only own posts
 */

add_filter( 'pre_get_posts', 'fb_pre_get_posts' );
function fb_pre_get_posts( $queryobj ) {

    if ( ! current_user_can( 'edit_users' ) )
        $queryobj->query_vars[ 'author' ] = get_current_user_id();

    return $queryobj;
} 

Answer 2

There is a separate capability for published posts:

 $role->add_cap( 'edit_published_employers' );