将特定用户角色的仪表板访问权限限制为特定操作

时间:2013-01-03 作者:laurayeffeth

我有一个脚本,允许登录用户(角色作者)使用get_delete_post_link(). 但是,我还希望能够限制作者对仪表板的访问。任何使用插件(例如,我的登录主题)或下面链接的简单脚本这样做的尝试都会禁用我使用get_delete_post_link(). 是否有方法限制“作者”用户角色对仪表板的访问,同时仍然允许通过get_delete_post_link()?

http://www.tutorialstag.com/restrict-wordpress-dashboard-access.html

How to restrict dashboard access to Admins only?

2 个回复
最合适的回答,由SO网友:laurayeffeth 整理而成

这就是我最终解决这个问题的原因。最初,我将此代码用于链接以删除单个帖子:

<?php if( !(get_post_status() == \'trash\') ) : ?>
<a class="delete-post" onclick="return confirm(\'Are you sure you wish to delete post: <?php echo get_the_title() ?>?\')"href="<?php echo get_delete_post_link( get_the_ID() ); ?>">Delete</a>
<?php endif; ?>
在检查用户是否已登录以及该用户是否是本文作者之后。这并没有像我在原来的帖子中提到的那样奏效。

相反,我使用了一个简单的删除按钮(与上面提到的检查相同):

<form class="delete-post" action="<?php bloginfo(\'url\'); ?>/edit-post" method="post"> 
    <input id="post_id" type="hidden" name="postid" value="<?php the_ID(); ?>" /> 
    <input type="submit" value="Delete" />
</form>
这个jQuery脚本用于进行ajax调用,该调用将运行我的php脚本:

jQuery(document).ready(function($){  
    $(\'.delete-post\').bind(\'click\', function(e){

        e.preventDefault();

        var post_id;
        post_id = $("#post_id").val();
        var data = {};
        var obj = {data: data}; 
        data[\'post_id\'] = post_id;

        alert(\'Are you sure you wish to delete this post?\');
        process_delete_post();

        function process_delete_post() {
            jQuery.ajax({
                type: "POST",
                url: run_delete_post.ajaxurl,
                data: ({
                    post_id : data[\'post_id\'],
                    action : \'run_delete_post_script\',
                }),
                success: function() {
                     location.href = "";
                },

                error: function(jqXHR, exception) {
                    if (jqXHR.status === 0) {
                        alert(\'Not connect.\\n Verify Network.\');
                    } else if (jqXHR.status == 404) {
                        alert(\'Requested page not found. [404]\');
                    } else if (jqXHR.status == 500) {
                        alert(\'Internal Server Error [500].\');
                    } else if (exception === \'parsererror\') {
                        alert(\'Requested JSON parse failed.\');
                    } else if (exception === \'timeout\') {
                        alert(\'Time out error.\');
                    } else if (exception === \'abort\') {
                        alert(\'Ajax request aborted.\');
                    } else {
                        alert(\'Uncaught Error.\\n\' + jqXHR.responseText);
                    }
                }

            });
        }   

    }); 

}); 
在我的功能中。php文件,我设置了ajax调用:

function mytheme_delete_post() {
    if ( is_page_template( \'edit-delete-posts.php\' ) ) {
        wp_enqueue_script( \'process-delete-post\', get_template_directory_uri().\'/js/process-delete-post.js\', array(\'jquery\'), true);
        wp_localize_script( \'process-delete-post\', \'run_delete_post\', array( \'ajaxurl\' => admin_url( \'admin-ajax.php\' ) ) );
        }
}
add_action(\'template_redirect\', \'mytheme_delete_post\');

$dirName = dirname(__FILE__);
$baseName = basename(realpath($dirName));
require_once ("$dirName/functions_custom.php");

add_action("wp_ajax_run_delete_post_script", "run_delete_post_script");     
然后,用实际的php脚本在my functions\\u custom中删除帖子。php文件:

function run_delete_post_script() {
    // Test for current user
    mytheme_get_current_user();

    //Get the data from the submit page and convert to php variables
    foreach ($_POST as $field => $value) {
        if (isset($_POST[$field])) {
            $$field = $value;
        }
    }
    wp_delete_post( $post_id );
}

SO网友:bosco

当作者试图查看仪表板时,如何进行定向重定向?

function restrict_dashboard_access() {
    //Leave AJAX requests alone - their life is hard enough without further scrutany
    if( $_SERVER[\'PHP_SELF\'] == \'/wp-admin/admin-ajax.php\' )
        return;

    if( $_SERVER[\'PHP_SELF\'] == \'/wp-admin/post.php\' && isset( $_REQUEST[\'action\'] ) ) {
        switch( $_REQUEST[\'action\'] ) {
            case \'trash\': //Leave alone requests to delete posts,
            case \'delete\'://such as those generated by get_delete_post_link()
                return;
        }
    }

    //For all other admin requests,

    //redirect users of the \'author\' role to the home_url
    $user = get_userdata( get_current_user_id() );
    if( in_array( \'author\', $user->roles ) ) {
        wp_redirect( home_url() );
        exit;  //Force script death to avoid useless script execution post-redirect
    }
}
add_action( \'admin_init\', \'restrict_dashboard_access\', 1 );
(从您的链接资源和the WP Codex page for the admin_init action)

EDIT: 如何根据评论中提供的其他信息实现删除后重定向到特定URL:

function restrict_dashboard_access() {
    //Leave AJAX requests alone - their life is hard enough without further scrutany
    if( $_SERVER[\'PHP_SELF\'] == \'/wp-admin/admin-ajax.php\' )
        return;

    if( $_SERVER[\'PHP_SELF\'] == \'/wp-admin/post.php\' && isset( $_REQUEST[\'action\'] ) ) {
        switch( $_REQUEST[\'action\'] ) {
            case \'trash\': //Leave alone requests to delete posts,
            case \'delete\'://such as those generated by get_delete_post_link()
                return;
        }
    }

    //For all other admin requests, redirect users of the \'author\' role
    $user = get_userdata( get_current_user_id() );
    if( in_array( \'author\', $user->roles ) ) {

        if( $_SERVER[\'PHP_SELF\'] == \'/wp-admin/edit.php\' && ( isset( $_REQUEST[\'trashed\'] ) || isset( $_REQUEST[\'deleted\'] ) ) ) {
            // If an Author has just deleted a post - redirect them to a specific URL.
            wp_redirect( home_url() . \'/post-deleted-page\' );
        } else {
            // If an Author is viewing any other admin page, drop them back to the homepage
            wp_redirect( home_url() );
        }

        exit;  //Force script death to avoid useless script execution post-redirect
    }
}
add_action( \'admin_init\', \'restrict_dashboard_access\', 1 );

结束

相关推荐

是否可以使用ADMIN_BAR_MENU或其他操作来修改管理员端的管理员栏?

我用过add_action(\'admin_bar_menu\', \'modify_admin_bar\') 更改WordPress(用户看到的站点)的“前端”上的管理栏。然而,似乎modify_admin_bar() 在“后端”(WordPress的仪表板或管理端)上呈现管理栏之前,不会调用。如何修改WordPress管理端显示的管理栏?这里有一个例子。。。add_action( \'admin_bar_menu\', \'modify_admin_bar\', 95 ); function