The Best Way
ALL THESE ANSWERS HERE HAVE SECURITY CONCERNS.
The best way is adding custom capabilities and managing posts etc. by the capabilities.
An easy way
Artem's solution seems to be better because WP doesn't refer post counts only on post edit screen but also within Dashboard widget, Ajax response etc.
For better solution based on Artem's one.
- clear the default post counts cache.
why: wp_count_posts earlierly returns the cached post counts when the result has been cached before.
- cache the result of custom post counts.
why: cache increases the performance.
- respect the 3rd
$perm parameter of wp_count_posts hook.
why: the post counts should includes user's own private posts based on readable perm.
- apply filters as high priority filters.
why: the filters might be overridden by other filters.
- remove (or modify) sticky posts count.
why: sticky posts count includes other's posts and they are separatedly counted by WP_Posts_List_Table.
- use proper capability for Custom Post Type
why: read_others_posts capability could be modified.
You might want to additional tweaks
- filter others posts' comments by setting
post_author query var to WP_Comment_Query.
- tweaks comments count by
wp_count_comments hook.
- prevent access to admin screens that should be restricted.
The following is a modified version based on wp_post_counts() of WP 4.8.
function clear_cache() {
// deletes the default cache for normal Post. (1)
$cache_key = _count_posts_cache_key( 'post' , 'readable' );
wp_cache_delete( $cache_key, 'counts' );
}
add_action( 'admin_init', 'clear_cache' ); // you might use other hooks.
function fix_count_orders( $counts, $type, $perm ) {
global $wpdb;
if ( ! post_type_exists( $type ) ) {
return new stdClass();
}
$query = "SELECT post_status, COUNT( * ) AS num_posts FROM {$wpdb->posts} WHERE post_type = %s";
$post_type_object = get_post_type_object( $type );
// adds condition to respect `$perm`. (3)
if ( $perm === 'readable' && is_user_logged_in() ) {
if ( ! current_user_can( $post_type_object->cap->read_private_posts ) ) {
$query .= $wpdb->prepare(
" AND (post_status != 'private' OR ( post_author = %d AND post_status = 'private' ))",
get_current_user_id()
);
}
}
// limits only author's own posts. (6)
if ( is_admin() && ! current_user_can ( $post_type_object->cap->edit_others_posts ) ) {
$query .= $wpdb->prepare( ' AND post_author = %d', get_current_user_id() );
}
$query .= ' GROUP BY post_status';
$results = (array) $wpdb->get_results( $wpdb->prepare( $query, $type ), ARRAY_A );
$counts = array_fill_keys( get_post_stati(), 0 );
foreach ( $results as $row ) {
$counts[ $row['post_status'] ] = $row['num_posts'];
}
$counts = (object) $counts;
$cache_key = _count_posts_cache_key( $type, 'readable' );
// caches the result. (2)
// although this is not so efficient because the cache is almost always deleted.
wp_cache_set( $cache_key, $counts, 'counts' );
return $counts;
}
function query_set_only_author( $wp_query ) {
if ( ! is_admin() ) {
return;
}
$allowed_types = [ 'post' ];
$current_type = get_query_var( 'post_type', 'post' );
if ( in_array( $current_type, $allowed_types, true ) ) {
$post_type_object = get_post_type_object( $current_type );
if (! current_user_can( $post_type_object->cap->edit_others_posts ) ) { // (6)
$wp_query->set( 'author', get_current_user_id() );
add_filter( 'wp_count_posts', 'fix_count_orders', PHP_INT_MAX, 3 ); // (4)
}
}
}
add_action( 'pre_get_posts', 'query_set_only_author', PHP_INT_MAX ); // (4)
function fix_views( $views ) {
// For normal Post.
// USE PROPER CAPABILITY IF YOU WANT TO RISTRICT THE READABILITY FOR CUSTOM POST TYPE (6).
if ( current_user_can( 'edit_others_posts' ) ) {
return;
}
unset( $views[ 'sticky' ] );
return $views;
}
add_filter( 'views_edit-post', 'fix_views', PHP_INT_MAX ); // (5)
Known Issue: Sticky posts that don't belong to user are counted. fixed by removing sticky posts view.
