0

I've built a marketplace-type site that gives users the option to post, edit, and delete listings via get_delete_post_link().

For those listings, I've set up custom post types.

The problem is that only administrators are able to delete posts. The link displays correctly, but when clicked the user either is returned to the site's home page or to the current page, but nothing happens to the post.

I'm really confused about this and have spent several hours googling and trying various solutions, but none of them worked.

Among the things I tried are:

  • setting map_meta_cap to both true and false and setting up either custom capability_type or leaving it at post.
  • setting up a custom user role with specific capability_type permissions
  • installing the Members Plugin and assigning literally all available 181 permissions to the Subscriber role without any effect (i.e. when I var_dump() the capabilities it looks exactly like an admin, but behaves differently)
  • logging out various checks (is_user_logged_in(), current_user_can(), $post->post_author == $current_user->ID, etc.)
  • passing various combinations of arguments to get_delete_post_link()

I'm at the end of my wits with this.

I'd also appreciate any advice on alternative methods of "deleting" my posts. I've also though about coding up a custom AJAX function, but was scared that it would fail because of the same strange permission problem (if it is a permission problem).

Thanks for your help!

5
  • Do you mean the delete link displays and work fine for administrator but for non administrator it displays but doesn't work? Apr 20 '17 at 12:04
  • exactly like that.
    – dtx
    Apr 20 '17 at 15:51
  • The user should have delete_post capability to make it work. Apr 21 '17 at 9:52
  • The user does have that capability, the problem is that it still doesn't work...
    – dtx
    Apr 22 '17 at 15:06
  • If you share your whole code in question then we can better help you. Apr 22 '17 at 15:15
1

Same problem here, that I've fixed. If it's not you, maybe this will help someone.

Did you blocked the non-admin users from accessing to the /wp-admin Dashboard ? The link provide by get_delete_post_link() use wp-admin, so if you blocked the access to the non-admin, they can't execute the delete.

0

If anyone is facing the issue mentioned above by Mnstd this little patch should allow users to delete posts using get_delete_post_link() while still keeping them away from /wp-admin/

function block_users_backend() {
    $current_url = $_SERVER['REQUEST_URI'];
    if ( is_admin() && ! current_user_can( 'administrator' ) && ! wp_doing_ajax() && !strpos($current_url,'action=trash')) {
        wp_redirect( home_url() );
        exit;
    }
}
add_action( 'init', 'block_users_backend' );
1
  • The downside to the strpos() check is that any user could still access dashboard pages per usual by simply appending action=trash to any other URL. Not that end-users are likely to figure that out, but it still presents a potential security issue. A better solution might be to use the get_delete_post_link filter to re-route users who should not have access to the dashboard to a custom admin_post_{custom action} handler, which would allow you to implement the deletion functionality while still completely restricting access to the dashboard.
    – bosco
    Jun 15 '21 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.