Delete Post From front Page ( With Wp-admin restriction )

6 comments

1. If you like, that users only can delete his own post, then it is important, that check for the ID of the user and the Author-ID to the post. The follow source example add a Trash button to the admin bar, that the users can easily delete his own post.

   The key is the function get_queried_object(). This object stored all values to the post on the front end and you can check to the user id, there is logged in – get_current_user_id(). Also important for a strict comparison is, that you set all values to the same type, like integer.

   Also is it possible to use the WP core function current_user_can() with the second param to identifier the rights to each post: current_user_can('edit_post', 123) this check the capability to the post with the ID 123. Maybe a little bid easier as the check about the author object and the post object.

   Also useful in my example, that you nit must use the global $post.

   add_action( 'admin_bar_menu', 'fb_add_admin_bar_trash_menu', 35 );
   function fb_add_admin_bar_trash_menu() {
   
     if ( ! is_super_admin() || ! is_admin_bar_showing() )
         return;
   
     $current_object = get_queried_object();
   
     // check, is the objekt with the value readable
     if ( ! isset( $current_object->post_author ) )
         return;
   
     // check, if the user id the same as the author-id if the current post
     if ( (int) $current_object->post_author !== (int) get_current_user_id() )
         return;
   
     if ( empty( $current_object ) )
         return;
   
     if ( ! empty( $current_object->post_type ) && 
        ( $post_type_object = get_post_type_object( $current_object->post_type ) ) && 
        current_user_can( $post_type_object->cap->edit_post, $current_object->ID ) 
     ) {
       global $wp_admin_bar;
   
       $wp_admin_bar->add_menu( 
           array(
               'id'    => 'delete', 
               'title' => __( 'Move to Trash' ), 
               'href'  => get_delete_post_link( $current_object->term_id ) 
           ) 
       );
     }
   }
   

   For the non access to the admin area of non admin is it easier to write a small function include a rewrite, not a hard die. Use the WordPress function wp_redirect() to rewrite to a specific url or frontend.

   add_action( 'admin_init', 'fb_redirect_to_frontend' );
   function fb_redirect_to_frontend() {
   
       if ( ! current_user_can( 'remove_users' ) )
           wp_redirect( site_url() );
   }
   

2. The solution to this is to modify your restrict admin function to allow for certain circumstances.

   function restrict_admin() {
   
       // Bail if a user is trying to trash a post.
       if ( isset( $_GET[ 'action'] ) && 'trash' == $_GET[ 'action'] )
           return;
   
       // Kill execution if not an administrator.
       if ( ! current_user_can( 'create_users' ) )
           wp_die( __( 'You are not allowed to access this part of the site' ) );
   }
   add_action( 'admin_init', 'restrict_admin', 1 );
   

3. How about changing the user’s role as author??
   Doing this, the user will have the edit_post capability but only for the post they have created not for other’s post.

4. You can use the capability delete_published_posts and delete_published_pages to provide the facility. This capability is provided to Author and upwards by default. This means whether the user can delete his published post(as you are deleting post from front end, so it must be published post).

   You can check it like this.

   if (!current_user_can('delete_published_posts') {
       return;
   }
   
   if (!current_user_can('delete_published_pages') {
       return;
   }
   

5. If you need to have very fine-grained permissions checking, you can filter the user_has_cap result. WordPress calls that function whenever it checks for permissions.

   You use it like this:

   add_filter ('user_has_cap', 'your_function', 10, 3);
   
   function your_function ($allcaps, $caps, $args) {
       if ($allow_this_action == true)
           return $allcaps;
       elseif ($allow_this_action == false) {
           $allcaps[$caps[0]] = false;
           return $allcaps;
       }
   }
   

   When a post is being deleted, $args is set to array (‘delete_post’, $user_id, $post_id). The capabilities required to allow the deletion are stored in the array $caps, and will vary depending on what type of post is being deleted (e.g. ‘delete_published_posts’). Each capability in $caps corresponds to an item in $allcaps. To prevent the post being deleted, all we need to do is modify $allcaps by setting one of the values listed in $caps to false (e.g. $allcaps[$caps[0]] = false).

6. Check out the ‘Delete Post’ plugin by business entourage on the WordPress plugins page, it allows only the author of the post to click a delete post button on the front end and it works great! And for an upgraded version, all users on a blog who make a comment can delete a comment only they made, making it more social. https://wordpress.org/plugins/delete-post/.

Comments are closed.