user_has_cap │ filter-hook │ WP 2.0.0

Allows you to remove or add capabilities for an individual user.

Usage

add_filter( 'user_has_cap', 'wp_kama_user_has_cap_filter', 10, 4 );

/**
 * Function for `user_has_cap` filter-hook.
 * 
 * @param bool[]   $allcaps Array of key/value pairs where keys represent a capability name and boolean values represent whether the user has that capability.
 * @param string[] $caps    Required primitive capabilities for the requested capability.
 * @param array    $args    Arguments that accompany the requested capability check.
 * @param WP_User  $user    The user object.
 *
 * @return bool[]
 */
function wp_kama_user_has_cap_filter( $allcaps, $caps, $args, $user ){

	// filter...
	return $allcaps;
}

$allcaps(array)

Array of all user capabilities.

An array of key => value pairs, where each key is a capability name and the boolean value indicates whether the user has that capability.

$caps(array)

Primitive capabilities required for the requested capability. The value returned by map_meta_cap().

$args(array)

Additional arguments passed to current_user_can() or WP_User::has_cap(), normally an object ID (post, comment, or user).

$user(WP_User)

User object whose capabilities are being filtered.

Examples

#1 Add capability names to users' capability lists at runtime

#2 Allow a logged-out user to update a post

Suppose logged-out users can update certain post data on the front end, such as adding tags. The post is updated with wp_update_post().

By default, WordPress does not permit a logged-out user to do this, so the required capability must be granted. Attach a function to user_has_cap and add permission to edit posts in that function.

This is safe in the example because the code itself selects and sanitizes the post fields to update.

For example, an AJAX request receives a taxonomy term name that should be added to a post:

// ... Code that obtains GET/POST data.

// Allow any user to update any post, including this one.
add_filter( 'user_has_cap', 'add_editor_cap_for_unauthorizes_user' );

function add_editor_cap_hb( $allcaps ){

	$allcaps['edit_posts'] = true;

	return $allcaps;
}

$post_data = [
	'ID' => 654,
	'tax_input' = [
		'tax_name' => [ 'Term Name' ],
	],
];

// Update the post.
wp_update_post( wp_slash( $post_data ) );

// Revoke the permission.
remove_filter( 'user_has_cap', 'add_editor_cap_for_unauthorizes_user' );

// ... Other code.