2

I have run into this problem where the following piece of code always returns true for any post ID supplied to it.

current_user_can('delete_posts', $post_id);

Normally, the above code should return false when the user is not the author of the post or does not have the capability to delete others post. However, it still returns true for any post ID.

The user has been assigned a custom role, as defined below.

$standard_role_capabilities = array ('read'                 => true,
                                    'delete_posts'              => true,
                                    'edit_posts'                => true,
                                    'delete_published_posts'    => true,
                                    'publish_posts'             => true,
                                    'edit_published_posts'      => true,
                                    'comment'                   => true
                            );

add_role('standard', 'Standard', $standard_role_capabilities);

Any reasons for this not working?

2
  • You should accept your answer. It is funny, because I thought to look at whether it should be plural or not, because it seemed like it should be, and then I just decided that it must be right...
    – Jake
    Aug 23, 2012 at 16:16
  • @Jake I'd have to wait for 24hrs before I can accept my answer. Will do once 24hrs go by.
    – John
    Aug 23, 2012 at 18:13

3 Answers 3

5

After hours of fighting to get this to work, it was just a matter of changing delete_posts to delete_post.

So, in it's entirety this would be:

current_user_can('delete_posts', $post_id);

to

current_user_can('delete_post', $post_id);

current_user_can does accept a second parameter. Though it's weird that the function declaration in capabilities.php does not define a second parameter as pointed out by @amit. May be someone can clarify why it is so.

1
  • 3
    The reason that only the first parameter is documented is because the value of any other parameter(s) varies based on the capability being checked. As you can see, the other parameters provide context for the capability. For 'delete_post' the second parameter is the ID of the post. For other capabilities, it might be something different, or not used at all (as with 'delete_posts').
    – J.D.
    Apr 1, 2014 at 13:32
1

If you want to check if user can delete posts of other authors, you need to use proper capability - delete_others_posts.

4
  • 1
    Well, thx for the suggestion. However, this won't work. I need to check whether a particular post could be deleted by the current user. Not whether the user can delete others posts.
    – John
    Aug 22, 2012 at 14:16
  • This seems like your answer. You have given your user the abilty to delete all posts. If you want to give them the ability to only delete their own posts, you need to define that in their capabilities. You haven't done that. So define "delete_others_posts" => false in their capabilities, and then you can check the way you are currently and it will work.
    – Jake
    Aug 23, 2012 at 1:29
  • @Jake The user has only been given the capability to delete their own posts. User does not have the capability to delete_others_posts. BTW, got this working. Please see the answer I added.
    – John
    Aug 23, 2012 at 7:18
  • I see, the default is off, of course. I wasn't thinking right. Glad you got it working.
    – Jake
    Aug 23, 2012 at 16:15
0

EDIT -

There's another function author_can() Which'll accept post ID.

current_user_can() function accepts only one parameter, we can not pass the post id to it.

Parameters -

$capability
(string) (required) capability
Default: None

Example -

May be this is not the best way to achieve what you're looking for -
I guess in the below code, the if block will only get executed when current user is author of that post and has capability - delete_posts

<?php

    $current_user = wp_get_current_user();
    $author = get_the_author_meta('ID');

    if ( current_user_can('delete_posts') && ( $current_user->ID == $author ) ) {
        //  when current user is author with `delete_posts` capability
    }

?>

Update -

Allow user to delete his own posts but disallow deletion of others post.
If deletion is based on author of post then an administrator will not be able to delete the post even though the administrator has the privileges

Change the if statement to something like this -

    if ( current_user_can('activate_plugins') || ( $current_user->ID == $author ) ) 
    {
        //  when current user is author or admin
    }
8
  • 1
    That's what I'd thought. However, looking at the edit_posts example on the Codex page (codex.wordpress.org/Function_Reference/current_user_can) for current_user_can I'd say it could accept the post ID as well.
    – John
    Aug 22, 2012 at 14:14
  • Ok, see my edit, I think you're looking for author_can() function.
    – Amit Kosti
    Aug 22, 2012 at 14:18
  • author_can will not work. It checks whether the author of the post has a particular capability. Rather here I am looking whether a particular user can delete a given post. Two different things going in there. I hope it makes sense.
    – John
    Aug 22, 2012 at 14:23
  • If current user has cap to delete_posts then he can delete any post. So you want to prevent that user from deleting other users post ?
    – Amit Kosti
    Aug 22, 2012 at 14:57
  • Yep! Exactly. Allow user to delete his own posts but disallow deletion of others post. This should be based on user's capability. Not on whether the user is the author of the post. If deletion is based on author of post then an administrator will not be able to delete the post even though the administrator has the privileges.
    – John
    Aug 22, 2012 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.