0

What would cause front end Ajax requests to not work for certain user roles?

I have successfully registered (enqueued) my .js file and I know that I have registered ajaxurl successfully as if I alert(myhandle.ajaxurl) I see the correct path to admin-ajax.php.

When I login as admin, and go to my front end the Ajax executes successfully. However, when logged in with a custom user role, it does not work... In fact, I know it is not executing my PHP file which should be called for the Ajax response as if I enter a error_log entry it does not get written. I know the file is available however as if I add that same error_log entry at the top of the file (outside my function) it does get written!

Is there anything obvious I may have missed?

Here are the snippets of relevant code in use

// My main plugin class

include( MDJM_CLIENTZONE . '/includes/mdjm-dynamic.php' ); // Ajax functions, front & backend

// Class where the enqueue is performed

function __construct()  {
    /* -- Hooks -- */
    add_action( 'wp_enqueue_scripts', array( &$this, 'client_zone_enqueue' ) ); // Styles & Scripts     
}


function client_zone_enqueue()    {
    wp_register_script( 'mdjm-dynamics', WPMDJM_PLUGIN_URL . '/client-zone/includes/js/mdjm-dynamic.js', array( 'jquery' ) );
}

// mdjm-dynamic.php

function update_addon_options() {
    $dj = $_POST['dj'];
    $event_package = $_POST['package'];
    $addons = mdjm_addons_dropdown( array( 
                                        'name'      => 'event_addons',
                                        'dj'        => !empty( $dj ) ? $dj : '',
                                        'package'   => $event_package,
                                        ), false );

    if( !empty( $addons ) ) {
        $result['type'] = 'success';
        $result['addons'] = $addons;
    }
    else    {
        $result['type'] = 'error';
        $result['msg'] = 'No addons available';
    }
    echo json_encode( $result );

    die();
} // update_addon_options
add_action( 'wp_ajax_mdjm_update_addon_options', 'update_addon_options' );
add_action( 'wp_ajax_nopriv_mdjm_update_addon_options', 'update_addon_options' );

// Page where the script should execute

wp_enqueue_script( 'mdjm-dynamics' );
wp_localize_script( 'mdjm-dynamics', 'mdjmaddons', array( 'ajax_url' => admin_url( 'admin-ajax.php' ) ) );

// JS

jQuery(document).ready(function($)  {
    $('#_mdjm_event_package').on('change', '', function()   {

        var package = $("#_mdjm_event_package option:selected").val();
        var dj = $("#event_dj").val();
        var addons = $("#event_addons");
        $.ajax({
            type: "POST",
            dataType: "json",
            url: mdjmaddons.ajax_url,
            data: {
                package : package,
                dj : dj,
                action : "mdjm_update_addon_options"
            },
            beforeSend: function()  {
                $("#event_addons").addClass( "mdjm-updating" );
            },
            success: function(response) {
                if(response.type == "success") {
                    $("#event_addons").removeClass( "mdjm-updating" );
                    addons.empty(); // Remove existing options
                    addons.append(response.addons);
                }
                else    {
                    alert(response.msg);
                    $("#event_addons").removeClass( "mdjm-updating" );
                }
            }
        });
    });
});

P.S. I know I am not checking security I will add this once current issue resolved.

As mentioned, this works in the back end, and also in the front end if logged in as an Admin. Just not when logged in as a user with a custom role. The JS executes as the addClass is working and the mdjm-dynamic.php file is available as I can send msgs to PHP error_log from outside the function when the file is included

  • Post your code please. – s_ha_dum Jul 9 '15 at 3:51
  • @s_ha_dum code snippets have now been included – Mike Jul 9 '15 at 11:48
  • Not the error I expected to see... is you user role created with no privileges? – s_ha_dum Jul 9 '15 at 12:53
  • add_role( 'custom_role', 'Custom Role', array( 'read' => true ) ); But shouldn't this also work for non-logged in users? – Mike Jul 9 '15 at 13:15
  • I changed the user in question to the Subscriber and then Contributor role. Both times this doesn't work. Seems to only work when logged in as admin? – Mike Jul 10 '15 at 8:28
0

OK I found the issue.

When directly entering myurl/wp-admin/admin-ajax.php?action= mdjm_update_addon_options into my browser window whilst logged in as an Administrator, I was getting the expected response of 0. However, when not logged in, or logged in as a non-admin, I noticed I was receiving "You do not have sufficient permissions to access this page".

Looking through my plugin files, I noticed that in my settings class I had the entry...

if( !current_user_can( 'manage_options') )
    die( "You do not have sufficient permissions to access this page." );

Remove this and all is now working fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.