2

I have created a custom user role in my functions.php file. I am creating a new page template for a page on my website that I would like to restrict by role(not by capabilities). Basically I would like to make it so that if a user with this new role or any editor/administrator role accesses the page they will see the content, otherwise it will display the default Wordpress login form. I also want it to send them back to this specific page after logging in. Here's the code I am using so far, it seems to be mostly working except that the redirect doesn't work. I also tried using wp_login_form() in place of the redirect, but that displays an unstyled form rather than what I would see by accessing wp-login:

<?php
/*
 * Template Name: Restricted content
 * Description: Restricted content template
 */

get_header(); ?>

<?php if( current_user_can('custom-role') || current_user_can('administrator') || current_user_can('editor')) { ?>

<div>
    Restricted content displayed here
</div>

<?php get_footer(); ?>

<?php

} else {
    wp_redirect(wp_login_url());
} 

?>
1
  • a redirection can only be used when the HTML are not been send. then you must test if you need to redirect before the call at get_header.
    – mmm
    Jan 11, 2018 at 19:01

1 Answer 1

2

WP can't redirect after you have already output HTML - so move your if/else to the top, before you call for the header, and only output the header & footer if your condition is met.

Also, instead of using current_user_can('role'), use current_user_can('capability') - i.e.

<?php if(
    current_user_can('activate_plugins') ||
    current_user_can('edit_a_defined_custom_post_type')
) {
    get_header(); ?>
    <div>Restricted content here</div><?php
    get_footer();
} else {
    wp_redirect(wp_login_url());
} ?>

(According to the Codex, "While checking against particular roles in place of a capability is supported in part, this practice is discouraged as it may produce unreliable results.")

3
  • Thank you! This worked for me. However, after logging in I am being taken to the profile page in the backend, is there any way for me to redirect them back to the restricted content if they login from this page? As for why I am using role instead of capabilities, this custom role only has "read" capabilities. So if I were to restrict it based on capabilities, then any registered user would be able to access this restricted content, rather than just the people with this custom role. Is there maybe a way to add a custom capability that wouldn't do anything other than be used as a condition?
    – user13286
    Jan 11, 2018 at 19:15
  • Was able to accomplish the first part of my question using this answer. Any ideas on the capabilities aspect? If it's working as intended do I need to worry about it?
    – user13286
    Jan 11, 2018 at 19:22
  • 1
    Since role-checking is discouraged, your idea to add a custom capability would be the safest bet. You can add a role with just "read" capability and if you explicitly deny other permissions like edit_posts, you'll be sure they can't do anything besides read. codex.wordpress.org/Function_Reference/add_role
    – WebElaine
    Jan 12, 2018 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.