TCPDF only exports .pdf when user is administrator

Question

Context

I use TCPDF for PDF generation hooked to admin-post. The admin-post-action handling function retrieves an object from database according to query parameters, requires a template.php and captures the html output, then writes it to TCPDF and generates a PDF with $pdf->Output('file.pdf', 'D');.

On a page I have a basic <a href=...> linking to admin-post.php?action=genPDF&objectIdentifier=xyz.

This whole thing is accessible only to logged in users with a custom capability, possessed only by administrator and custom client role .

Problem

After clicking the link as an administrator, a PDF is downloaded. When I click the link as client, the page just reloads.

Attempts to solve

I put some error_log() in the PDF-generating function and it does run for the client. I logged the html output captured from template.php and it shows the correct output. When I use Chrome's network inspector, I see the admin-post.php request response headers suggest a PDF file attachment with the correct filename specified in TCPDF Output call. I tried switching the "D" for "I" in output target specification to show PDF in browser instead of downloading it with the same result - administrator gets the PDF, client gets nothing.

The question

This makes no sense to me. Is there any way the WP user role could affect this? The same code is run for administrator and client, up to the point of generating the same HTML output from template and TCPDF setting the response headers.

Answer 1

This was due to 2 mistakes in code restricting client access to wp-admin.

• There was no exception for admin-post.php , so after a request to admin-post the client was redirected back to client area. Hence the 'reloads' after clicking the link.
• After the redirect in the restriction code, there was no die() or exit statement. Therefore the admin-post handler was able to continue running and TCPDF was able to set some HTTP response header info (content type: pdf), but HTTP status 302 was already sent and no file was downloaded. This confused me quite a lot.