1

I have 4 roles in my platform : administrator, author, editor, external

I need to restrict WordPress media library access to the user’s own uploads only for one users role (external) on my platform. The External user role can only see/select his own media.

All others roles still have access to all medias in the library.

I found the below snippets but it works for all the users :

<?php // Limit access to media library (users can only see/select own media) //
   add_filter( 'ajax_query_attachments_args', 'wpsnippet_show_current_user_attachments' );
   function wpsnippet_show_current_user_attachments( $query ) {
      $user_id = get_current_user_id();
      if ( $user_id && !current_user_can('activate_plugins') && !current_user_can('edit_others_posts')) {
         $query['author'] = $user_id;
      }
      return $query;
   }
?>

Thanks in advance for your reply.

3
  • I'd go with just another upload folder for external users. Catch the user role on login, distinguish upload folder by a filter based on that. Commented Nov 7, 2021 at 15:53
  • Is it possible to show me how to do this please ?
    – Samuel
    Commented Nov 7, 2021 at 18:20
  • Here's an answer that addresses the list-view version: wordpress.stackexchange.com/questions/271584/…
    – Michelle
    Commented Nov 12, 2021 at 20:11

2 Answers 2

0

add this to your functions.php or in a snippet, with this code the users with role external will only see their own uploads, any other role will see them all just has before.

add_filter( 'ajax_query_attachments_args', 'role_external' );
function role_external( $query ) {
    $user_id = get_current_user_id();
    if ( $user_id && current_user_can('external') ) {
        $query['author'] = $user_id;
    }
    return $query;
}
3
  • This will still show all images to people who use the list view, and if you can guess the edit URL they'll still be accessible as well.
    – kero
    Commented Nov 12, 2021 at 11:23
  • in my dashboard this works like a charm, however I didnt take in account the direct link to the images, that way probably they will still have access, about the list view, dont know it. Commented Nov 12, 2021 at 18:51
  • I can confirm that the solution above only works in grid mode. List mode shows all media files.
    – bugnumber9
    Commented Jul 22, 2022 at 10:56
0

to protect your image folder try use this

Add a simple .htaccess file in your site folder with the following lines

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://www\.your-domain\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www\.your-domain\.com$ [NC]
RewriteRule .*\.(wav|swf|jpg|jpeg|gif|png|bmp|js|css)$ - [F,NC,L]

Note I added also js and css file even if I think it's bizzare to find someone who attempts to scrape them.

this answer can be found here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.