User capability checks in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without 'edit_posts' capability tries to access this code?

Consider this WordPress PHP snippet inside a plugin or theme:

if ( current_user_can('edit_posts') ) {
    echo 'You can edit posts!';
} else {
    echo 'Access denied.';
}

What will be the output if the current user does NOT have the 'edit_posts' capability?

Wordpress

if ( current_user_can('edit_posts') ) {
    echo 'You can edit posts!';
} else {
    echo 'Access denied.';
}

A You can edit posts!

B Fatal error: undefined function current_user_can()

C Access denied.

D No output at all

💡 Hint

Think about what current_user_can() returns when the user lacks the capability.

The function current_user_can('edit_posts') returns false if the user does not have that capability. So the else block runs, printing 'Access denied.'

📝 Syntax

intermediate

Which option correctly checks if a user can 'manage_options' in WordPress?

Choose the correct PHP code snippet that checks if the current user has the 'manage_options' capability.

A if (current_user_can('manage_options')) { /* code */ }

B if (user_can('manage_options')) { /* code */ }

C if (current_user_can = 'manage_options') { /* code */ }

D if (current_user_can('manage_options') == false) { /* code */ }

💡 Hint

Remember the correct function name and syntax for capability checks.

The correct function is current_user_can() with the capability as a string argument. Option A uses this correctly.

Option A uses a wrong function name. Option A assigns instead of compares. Option A checks for false, which is valid but not the direct check asked.

❓ state_output

advanced

What is the output of this code when the user is logged out?

Analyze this WordPress PHP snippet:

if ( is_user_logged_in() && current_user_can('publish_posts') ) {
    echo 'Welcome, author!';
} else {
    echo 'Please log in.';
}

What will it output if the user is NOT logged in?

Wordpress

if ( is_user_logged_in() && current_user_can('publish_posts') ) {
    echo 'Welcome, author!';
} else {
    echo 'Please log in.';
}

A Welcome, author!

B Please log in.

C No output

D Fatal error: call to current_user_can() without user

💡 Hint

Consider how is_user_logged_in() affects the condition.

If the user is not logged in, is_user_logged_in() returns false, so the whole condition is false and the else block runs, printing 'Please log in.'

🔧 Debug

advanced

Why does this capability check always fail?

Look at this code snippet:

if ( current_user_can( 'edit_post' ) ) {
    echo 'Can edit post';
} else {
    echo 'Cannot edit post';
}

Why does it always print 'Cannot edit post' even for users who can edit posts?

Wordpress

if ( current_user_can( 'edit_post' ) ) {
    echo 'Can edit post';
} else {
    echo 'Cannot edit post';
}

A The echo statements are reversed.

B The function current_user_can() requires a user ID as second argument.

C The code is missing a call to wp_get_current_user() before checking.

D The capability name 'edit_post' is incorrect; it should be 'edit_posts'.

💡 Hint

Check the exact capability string spelling.

The capability 'edit_post' does not exist in WordPress. The correct capability is 'edit_posts' (plural). So the check always fails.

🧠 Conceptual

expert

Which statement about user capability checks in WordPress is TRUE?

Choose the correct statement about how WordPress handles user capability checks.

A current_user_can() checks capabilities only for the currently logged-in user and returns false if no user is logged in.

B current_user_can() can check capabilities for any user by passing a user ID as the second argument.

C User capabilities are stored in the database as plain text and checked directly by current_user_can().

D If a user lacks a capability, current_user_can() throws a fatal error.

💡 Hint

Think about the function's behavior when no user is logged in.

current_user_can() checks capabilities only for the current logged-in user. If no user is logged in, it returns false. It does not accept a user ID argument. Capabilities are stored serialized in the database and checked internally. It never throws fatal errors for missing capabilities.

Practice

1. What is the main purpose of the current_user_can() function in WordPress?

easy

A. To check if the current user has a specific capability

B. To create a new user role

C. To delete a user from the database

D. To update the user's profile information

Solution

1. Step 1: Understand the function's role

   current_user_can() is designed to check permissions for the current user.

2. Step 2: Identify correct usage

   It returns true if the user has the capability passed as an argument, otherwise false.

3. Final Answer:

   To check if the current user has a specific capability -> Option A

4. Quick Check:

   Permission check = A [OK]

Hint: Remember: current_user_can checks permissions, not user creation [OK]

Common Mistakes:

• Confusing capability check with user creation
• Thinking it modifies user data
• Assuming it deletes users

2. Which of the following is the correct syntax to check if the current user can edit posts?

easy

A. current_user_can(edit_posts);

B. current_user_can['edit_posts'];

C. current_user_can('edit_posts');

D. current_user_can->edit_posts();

Solution

1. Step 1: Identify correct function call syntax

   WordPress functions use parentheses and string arguments in quotes.

2. Step 2: Check each option

   Only current_user_can('edit_posts'); uses parentheses and quotes correctly.

3. Final Answer:

   current_user_can('edit_posts'); -> Option C

4. Quick Check:

   Function call with string argument = B [OK]

Hint: Use parentheses and quotes for capability strings [OK]

Common Mistakes:

• Omitting quotes around capability
• Using square brackets instead of parentheses
• Using arrow notation incorrectly

3. What will the following code output if the current user cannot delete posts?

if (current_user_can('delete_posts')) {
  echo 'Can delete posts';
} else {
  echo 'Cannot delete posts';
}

medium

A. Can delete posts

B. No output

C. Error: function not found

D. Cannot delete posts

Solution

1. Step 1: Understand the condition

   The if checks if the user has 'delete_posts' capability.

2. Step 2: Evaluate the condition result

   If the user cannot delete posts, the condition is false, so the else block runs.

3. Final Answer:

   Cannot delete posts -> Option D

4. Quick Check:

   False condition triggers else = D [OK]

Hint: If user lacks capability, else block runs [OK]

Common Mistakes:

• Assuming output is always 'Can delete posts'
• Confusing capability names
• Expecting errors if capability missing

4. Identify the error in this code snippet:

if (current_user_can('edit_post')) {
  echo 'User can edit post';
}

medium

A. Missing semicolon after echo statement

B. The capability name should be 'edit_posts' not 'edit_post'

C. current_user_can() requires two arguments

D. The function should be called as currentUserCan()

Solution

1. Step 1: Check capability name correctness

   WordPress uses 'edit_posts' (plural) as the capability, not 'edit_post'.

2. Step 2: Verify syntax and function usage

   Semicolon is present, function takes one argument, and function name is correct.

3. Final Answer:

   The capability name should be 'edit_posts' not 'edit_post' -> Option B

4. Quick Check:

   Correct capability string = A [OK]

Hint: Check exact capability names in WordPress docs [OK]

Common Mistakes:

• Using singular instead of plural capability names
• Assuming function needs multiple arguments
• Incorrect function name casing

5. You want to show a special admin menu only to users who can manage options and edit themes. Which code correctly checks both capabilities before showing the menu?

hard

A. if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); }

B. if (current_user_can('manage_options' || 'edit_themes')) { show_menu(); }

C. if (current_user_can(['manage_options', 'edit_themes'])) { show_menu(); }

D. if (current_user_can('manage_options') || current_user_can('edit_themes')) { show_menu(); }

Solution

1. Step 1: Understand logical AND for both capabilities

   To require both permissions, use && between two separate current_user_can() calls.

2. Step 2: Evaluate each option's logic

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } correctly uses && with two calls; A and B misuse syntax; D uses || which allows either permission.

3. Final Answer:

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } -> Option A

4. Quick Check:

   Both capabilities require && = C [OK]

Hint: Use && with separate calls to check multiple capabilities [OK]

Common Mistakes:

• Using || instead of && when both permissions are needed
• Passing multiple capabilities as one argument
• Using incorrect syntax for logical operators