Customize users’ capabilities to change a custom post’s post status

by

I’ve got a somewhat unique scenario that I would appreciate some assistance with.

I have a custom post type, coin, for content that is automatically created by an custom import process. I would like to restrict all users from performing certain actions on any coin posts. Specifically, I want to prevent any user from deleting a coin, changing the published status, or changing the visibility.

I have registered a post type: 

function my_post_type() {
    register_post_type('coin',
            array(
                'labels' => array(
                    'name' => __( 'Coins' ),
                    'singular_name' => __( 'Coin' ),
                    'view_item' => __( 'View Coin' ),
                    'edit_item' => __( 'Edit Coin' ),
                    ),
                'public' => true,
                'menu_position' => 5,
                'capability_type' => 'coin',
                )
            );
}
add_action('init', 'my_post_type');

I have specified how to handle the capabilities: 

function my_map_meta_cap( $caps, $cap, $user_id, $args ) {
    if (preg_match('/_coins?$/', $cap) == 1){
        $post = get_post( $args[0] );
        $post_type = get_post_type_object( $post->post_type );
        $caps = array();
        $disallowed = array(
                'delete_coin',
                'publish_coins',
                );
        if (in_array($cap, $disallowed)){
            $caps[] = 'do_not_allow';
        }
    } 
    return $caps;
}
add_filter( 'map_meta_cap', 'my_map_meta_cap', 10, 4 );

This does prevent the deletion of coin posts. This does prevent the adjustment of the visibility of a coin post. This does prevent users from publishing a coin post. However, it does not prevent users from changing a coin post status to draft or pending review.

Additionally, I would like to prevent users from being able to add new coin posts as coin posts should only be created by the import routine. I have not found any information about how I could do this.

Can anyone help me or am I asking too much of wordpress?

1 Answer
1

There’s not a good way to do this as the code for this section is pretty rigid. You can simply remove the elements via JavaScript. By removing (and not just hiding) the elements, you disable the functionality. You can customize the following to your needs I’m sure.

  1. Use CSS to hide the post actions inner box so the prohibited buttons never display to the screen. Without this, you will see the buttons for a moment and then they disappear.
  2. Removals of the elements
  3. Show the post publishing actions inner box again.

Example:

add_action('admin_head-post.php', 'remove_publishing_actions');
add_action('admin_head-post-new.php', 'remove_publishing_actions');
function remove_publishing_actions(){
    global $post;
    if($post->post_type == 'post'){
        //check user capabilities here
        echo "<style type="text/css">
                /* hide the publishing box until we remove the elements */
                #submitpost{display:none;}
            </style>";

        echo "
            <script type="text/javascript">
                jQuery(document).ready(function($){
                    //Remove whatever elements you don't want
                    $('#misc-publishing-actions, #save-action, #delete-action').remove();
                    //Show the publish actions
                    $('#submitpost').show();
                });
            </script>

        ";
    }
}

You should probably check for your custom user cap before echoing the style and script tags. Hope this helps!

Leave a Comment