0

I recently tried to make a form for users that are logged in to be able to add a post from the frontend to their profiles. The problems I have found are the following:

  1. ANYBODY can post from it, even if they are not logged in. This creates the post but in backend it is not assigned to an author.
  2. I don't have a way of uploading media even when adding the setting "media_buttons" to the wp_editor.
  3. The content I type into the text area does not save, only the Title.

Here is the code I used:

                    <div class="col-sm-12">
                       <!-- New Post Form -->
                        <form action="" id="primaryPostForm" method="POST">

                            <fieldset>
                                <label for="postTitle"><?php _e('Post Title:', 'framework') ?></label>

                                <input type="text" name="postTitle" id="postTitle" class="required" />
                            </fieldset>

                            <?php

                            $content = '';
                            $editor_id = 'mycustomeditor';

                            wp_editor( $content, $editor_id, $settings = array(

                                'media_buttons' => true,
                                'wpautop' => true,
                                'textarea_name' => 'product_info_content',
                                'editor_class' => 'requiredField'

                                ) );

                            ?>

                            <fieldset>
                                <input type="hidden" name="submitted" id="submitted" value="true" />

                                <button type="submit"><?php _e('Add Post', 'framework') ?></button>
                            </fieldset>

                        </form>
                        <!--// New Post Form -->

                        <?php

                        $post_information = array(
                            'post_title' => wp_strip_all_tags( $_POST['postTitle'] ),
                            'post_content' => $product_info_content,
                            'post_type' => 'post',
                            'post_status' => 'publish'
                        );

                        wp_insert_post( $post_information );

                        ?>
                </div>

Please help with the listed problems. I want to be able to upload media and ONLY the logged in users must be able to post from the form.

  • 1
    I mean... have you even looked at how to see if the user is currently logged in? e.g. is_user_logged_in() – ProEvilz Oct 23 '17 at 13:00
  • why don't you use the backend form ? – mmm Oct 23 '17 at 13:17
  • Also keep in mind you perform no sanitising of the content in your code, use wp_kses_post on the value so tags don't get stripped out – Tom J Nowell Oct 23 '17 at 13:28
  • @ProEvilz, I had a look. That part is solved now, thanks. I am new to WordPress and PHP so what might be obvious to you may not be to me. – Feyt Oct 23 '17 at 13:38
  • @TomJNowell, thank you for the advice. I will definitely implement some more secure features, I just want to solve the basic functionality first. I also believe this is or was a good practice too - wp_strip_all_tags(). I had a look at this example at this link too. – Feyt Oct 23 '17 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.