get_delete_post_link() only works for administrator, even if other user has exactly the same permissions

Question

I've built a marketplace-type site that gives users the option to post, edit, and delete listings via get_delete_post_link().

For those listings, I've set up custom post types.

The problem is that only administrators are able to delete posts. The link displays correctly, but when clicked the user either is returned to the site's home page or to the current page, but nothing happens to the post.

I'm really confused about this and have spent several hours googling and trying various solutions, but none of them worked.

Among the things I tried are:

• setting map_meta_cap to both true and false and setting up either custom capability_type or leaving it at post.
• setting up a custom user role with specific capability_type permissions
• installing the Members Plugin and assigning literally all available 181 permissions to the Subscriber role without any effect (i.e. when I var_dump() the capabilities it looks exactly like an admin, but behaves differently)
• logging out various checks (is_user_logged_in(), current_user_can(), $post->post_author == $current_user->ID, etc.)
• passing various combinations of arguments to get_delete_post_link()

I'm at the end of my wits with this.

I'd also appreciate any advice on alternative methods of "deleting" my posts. I've also though about coding up a custom AJAX function, but was scared that it would fail because of the same strange permission problem (if it is a permission problem).

Thanks for your help!

Answer 1

Same problem here, that I've fixed. If it's not you, maybe this will help someone.

Did you blocked the non-admin users from accessing to the /wp-admin Dashboard ? The link provide by get_delete_post_link() use wp-admin, so if you blocked the access to the non-admin, they can't execute the delete.

Answer 2

If anyone is facing the issue mentioned above by Mnstd this little patch should allow users to delete posts using get_delete_post_link() while still keeping them away from /wp-admin/

function block_users_backend() {
    $current_url = $_SERVER['REQUEST_URI'];
    if ( is_admin() && ! current_user_can( 'administrator' ) && ! wp_doing_ajax() && !strpos($current_url,'action=trash')) {
        wp_redirect( home_url() );
        exit;
    }
}
add_action( 'init', 'block_users_backend' );