Hot answers tagged

13

The problem with the code in your question is it always intercepts. You completely lose the ability to not publish, no drafts possible. Why this leads to untrashable post is something I didn't inspect further. Anyway this isn't what one wants. I'm glad the javascript solution is working for you, but personally I have two problems with it, first, you can save ...


11

It's not possible to call a private method through an action or filter. When calling add_action or add_filter, WordPress adds the callback to a list of callbacks for that specific action or filter. Then, when do_action or apply_filters is called, WordPress uses call_user_func_array to call the linked functions and methods. As call_user_func_array is not ...


9

There is no absolutely safe way to store such information permanently. You have two options to increase security a little bit: Use the options table and encrypt the data Use a strong encryption method, and bind it to either: your password when you want to use the API call only when you are logged in, or a secret key stored in your wp-config.php – then an ...


8

When a POST is set to private, non-logged in users will receive a 404 message. If you dump the global variable $wp_query, var_dump($wp_query); ..you will notice that no post_status is present in the parameters returned therefore using the slug (or name parameter of query_vars array for example) we can get the post status of the POST that is trying to be ...


8

I'm hereby answering my own question, because i found a solution, but I'm really interested in your opinions towards it. Or maybe you have a much better solution, if so, I really would like to here about it. Research result My research results were: 1. get the files outside of the document root, www folder; 2. disallow any direct access to the ...


7

Transients are just database keys that expire. It's like telling WordPress you want it to remember a certain piece of information, but for a limited time. In general, transients are accessible to PHP through any request. But since they're server-side, transients are only exposed to front-end users if you as the developer expose them. A Solution Given ...


7

You could redirect anything that's not a page or admin to home via the parse_query action: function wpa_parse_query( $query ){ if( ! is_admin() && ! $query->is_page() ) { wp_redirect( home_url() ); exit; } } add_action( 'parse_query', 'wpa_parse_query' ); If it's not an admin screen or a query for a page, it'll redirect. ...


5

I had a similar problem and here is the best solution I could come up with. The reason (I think) that private or non-published items show up in menus is that the menu items are themselves posts and have their own post_status. That means that in a situation where a page is marked private, the menu item for that page can still be set to publish, and is ...


5

A basic user login tracker is pretty trivial to implement. function track_user_login_wpse_100929($id,$user) { $tracking = get_user_meta($user->ID,'tracking_key_name',true); $tracking[] = time(); update_user_meta($user->ID,'tracking_key_name',$tracking); } add_action('wp_login','track_user_login_wpse_100929',1,2); After that you just need to ...


5

Transients are persistent storage mechanism. That means that by saving transient with certain key you will be able able to retrieve same transient with that same key (if it had not expired and cache have not been flushed since). "Public" does not really apply to them, since they are internal code concept and only thing that accesses them is your code, not ...


4

This is challenging, because showing something would require page not to be private. It is more common to leave page public, but make it produce conditional output depending on if user is logged (is_user_logged_in()) in or other criteria.


4

I used this as a solution for hiding draft pages. You can hide the (draft page) menu items with the li.draft class. add_filter('nav_menu_css_class' , 'nav_menu_add_post_status_class' , 10 , 2); function nav_menu_add_post_status_class($classes, $item){ $post_status = get_post_status($item->object_id); $classes[] = $post_status; return $classes;...


4

Joost de Valk's WordPress SEO plugin is capable of disabling most, if not all, archives you mention:


4

You're after post_password_required(): <?php if ( ! ( $post->post_password && post_password_required() ) ) get_sidebar() ?>


4

The answer is NO. If your DB can be spied on, your code probably can be as well so even if you encrypt data it can be decrypted. If you are going to store sensitive data there are no low level solution to help you with it and you just need to make your whole application secure to make the question of storage irrelevant. I actually ran into a requirement to ...


4

If you don't want to use a plugin (or can't find one that does what you're needing), you might want to approach it this way: Add a custom meta box that allows you to mark the post as hidden. Modifying the query with pre_get_posts to remove the posts you've labeled as hidden from your site (but will be available with a direct link). UPDATE Following the ...


3

This is just a modification of timshutes' answer - if you want specific pages to require login and don't want to put them into a custom post type, you can add to functions.php: add_shortcode('need_login', 'shortcode_needLogin'); function shortcode_needLogin() { if (!is_user_logged_in()) { auth_redirect(); } } And then at the top of the ...


3

Was just looking around for this answer myself in 2020 and it seems this is a great way to do it now. <?php if ( $wp_query->have_posts() ) : ?> <?php while ( $wp_query->have_posts() ) : ?> <?php $wp_query->the_post(); ?> <?php if ( get_post_status ( get_the_ID() ) == 'private' ) { ?> <h1>Private</h1&...


3

The easiest solution is to add a specific class to the menu items that you want to hide. And then hide them through CSS. ^ click to enlarge ^ The CSS classes are not visible by default, you have to enable it in the Screen Options upper tab. If your theme does not print the relevant classes in the <body> tag, this will do: add_filter( 'body_class',...


3

The problem is that changing the post visibility to private invokes a status change, in a way private is not only a visibility but also a publishing status. Or to quote the Wordpress Codex, section »Content Visibility - Private Content«. Once you change the visibility to private, the post or page status changes to "Privately Published" as shown. Private ...


3

We can use the protected_title_format and private_title_format filters, available since WordPress version 2.8: add_filter( 'protected_title_format', 'wpse_pure_title', 10, 2 ); add_filter( 'private_title_format', 'wpse_pure_title', 10, 2 ); function wpse_pure_title( $format, \WP_Post $post ) { return 'mycpt' === get_post_type( $post ) ? '%s' : $...


3

You need to filter the main WordPress query using the pre_get_posts action. This code will get you started: function show_only_private_post_for_logged_in_users( $query ) { if ( ! $query->is_main_query() || is_admin() ) { return; } if ( is_user_logged_in() ) { $query->set( 'post_status', 'private' ); } } add_action( '...


2

It's possible to put the check on the corresponding archive pages & single pages But the one thing you should definitely do along with all the other solutions you take is to use the the_posts filter. It filters out the posts that any WP_Query retrieves. You'll get an array of post objects. Check for the condition & unset the object if it is there. ...


2

Hiding them with CSS is problematic, as they still get sent over the wire and still expose what could be sensitive information to anyone who looks at the source, to those who disable CSS for whatever reason (e.g. blind users — CSS just slows them down to no real benefit), and to hacker scripts and the like. No, we need a way to allow menu items to be added ...


2

The correct way to automatically mark a post as private is to do it with the wp_insert_post_data filter. It's very straightforward: add_filter( 'wp_insert_post_data', 'mark_post_private' ); function mark_post_private( $data ) { if ( 'your_post_type_goes_here' == $data['post_type'] ) { $data['post_status'] = 'private'; } return $data; }


2

This is old - but here is how I solved this issue ultimately. Created a custom post type for Intranet Pages. Added a "force_login" function in functions.php Included the force login function at the top of all necessary page-template files. You could customize this to allow only for certain users - for instance, using the "Members" plugin @jason ...


2

According to the Content Visibility page, Private posts are visible only to those with sufficient permission levels. WordPress doesn't expose them to non-logged-in users at all, hence (presumably) the 404. If you want to display a limited preview to non-members, instead of setting the post to Private, you could try something like this: add_filter( '...


2

You can user another small script, without adding any plugin. There is a post here and the code to add in the index.php of your theme is this: if(is_archive()) { // force 404 $wp_query->set_404(); status_header( 404 ); nocache_headers(); include("404.php"); die; } Hope you find it useful.


2

This is the default WordPress behavior. http://codex.wordpress.org/Content_Visibility#Private_Content Private posts are automatically published but not visible to anyone but those with the appropriate permission levels (Editor or Administrator). WARNING: If your site has multiple editors or administrators, they will be able to see your protected ...


2

Figured this out after finding this page: http://www.0to5blog.com/tips/protecting-wordpress-media-uploads-unless-user-is-logged-in/ That page contains the instructions I was looking for, exactly! I tweaked the dl-file.php code slightly to meet my needs: if ( !current_user_can( 'read_private_posts' ) || !is_user_logged_in() ) {


Only top voted, non community-wiki answers of a minimum length are eligible