Prevent author role from editing all posts in custom post type?

Question

I thought the Author role was only allowed to edit posts created by that author. That works in Posts and Pages, but I created a custom post type and the author can edit ALL posts in that post type. Do you have to do something special for custom post types to make the Author role behave normally?

I tried using this code, which I found on another question, but it didn't fix it for me:

function to_parse_query_useronly( $wp_query ) {
    if ( strpos( $_SERVER[ 'REQUEST_URI' ], '/wp-admin/edit.php' ) !== false ) {
        if ( !current_user_can( 'publish_posts' ) ) {
            global $current_user;
            $wp_query->set( 'author', $current_user->id );
        }
    }
}
add_filter('parse_query', 'to_parse_query_useronly' );

Thank you!

Answer 1

You should declare your desired capabilities when you are registering the post type.

Justin's article here is a good one for custom post types: http://justintadlock.com/archives/2010/04/29/custom-post-types-in-wordpress

When you are registering your custom post type, you can set this to be standard capabilities for posts, eg:

'capability_type'    => 'post',

or to be standard capabilities for pages, eg.

'capability_type' => 'page',

or set your own capability type, with global controls or get right down to the specific controls through a specific array, eg.

/* Global control over capabilities. */
'capability_type' => 'super_duper',

/* Specific control over capabilities. */
'capabilities' => array(
'edit_post' => 'edit_super_duper',
'edit_posts' => 'edit_super_dupers',
'edit_others_posts' => 'edit_others_super_dupers',
'publish_posts' => 'publish_super_dupers',
'read_post' => 'read_super_duper',
'read_private_posts' => 'read_private_super_dupers',
'delete_post' => 'delete_super_duper',
),