User capability checks in Wordpress - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of user capability checks in WordPress?

User capability checks control what actions a user can perform based on their role and permissions. They help keep the site secure by limiting access to sensitive features.

beginner

Which WordPress function is commonly used to check if a user has a specific capability?

The current_user_can() function checks if the current logged-in user has a given capability, returning true or false.

beginner

How do you check if a user can edit posts in WordPress?

Use current_user_can('edit_posts'). It returns true if the user has permission to edit posts, false otherwise.

intermediate

Why should you always use capability checks before performing sensitive actions in WordPress?

To prevent unauthorized users from accessing or changing data they shouldn't. It protects your site from security risks and accidental damage.

intermediate

What is the difference between roles and capabilities in WordPress?

Roles are groups of capabilities assigned to users. Capabilities are specific permissions like 'edit_posts' or 'manage_options'. Roles bundle capabilities for easier management.

Which function checks if the current user can perform a specific action in WordPress?

A can_user_do()

B user_has_role()

C check_user_permission()

D current_user_can()

The correct function is current_user_can(), which checks user capabilities.

What does current_user_can('edit_posts') return if the user cannot edit posts?

A true

B null

C false

D error

It returns false if the user does not have the 'edit_posts' capability.

Which WordPress concept groups multiple capabilities together for users?

A Widgets

B Roles

C Filters

D Hooks

Roles group capabilities to assign sets of permissions to users.

Why is it important to check user capabilities before showing admin options?

A To prevent unauthorized access

B To change the site theme

C To improve site speed

D To backup the database

Checking capabilities prevents unauthorized users from accessing sensitive features.

Which capability would you check to allow a user to manage site settings?

A manage_options

B edit_posts

C publish_posts

D read

The 'manage_options' capability allows users to manage site settings.

Explain how user capability checks help secure a WordPress site.

Think about who can do what on your site and how you stop others.

Describe the difference between roles and capabilities in WordPress and why both are useful.

Roles are like job titles; capabilities are the tasks allowed.

Practice

1. What is the main purpose of the current_user_can() function in WordPress?

easy

A. To check if the current user has a specific capability

B. To create a new user role

C. To delete a user from the database

D. To update the user's profile information

Solution

1. Step 1: Understand the function's role

   current_user_can() is designed to check permissions for the current user.

2. Step 2: Identify correct usage

   It returns true if the user has the capability passed as an argument, otherwise false.

3. Final Answer:

   To check if the current user has a specific capability -> Option A

4. Quick Check:

   Permission check = A [OK]

Hint: Remember: current_user_can checks permissions, not user creation [OK]

Common Mistakes:

• Confusing capability check with user creation
• Thinking it modifies user data
• Assuming it deletes users

2. Which of the following is the correct syntax to check if the current user can edit posts?

easy

A. current_user_can(edit_posts);

B. current_user_can['edit_posts'];

C. current_user_can('edit_posts');

D. current_user_can->edit_posts();

Solution

1. Step 1: Identify correct function call syntax

   WordPress functions use parentheses and string arguments in quotes.

2. Step 2: Check each option

   Only current_user_can('edit_posts'); uses parentheses and quotes correctly.

3. Final Answer:

   current_user_can('edit_posts'); -> Option C

4. Quick Check:

   Function call with string argument = B [OK]

Hint: Use parentheses and quotes for capability strings [OK]

Common Mistakes:

• Omitting quotes around capability
• Using square brackets instead of parentheses
• Using arrow notation incorrectly

3. What will the following code output if the current user cannot delete posts?

if (current_user_can('delete_posts')) {
  echo 'Can delete posts';
} else {
  echo 'Cannot delete posts';
}

medium

A. Can delete posts

B. No output

C. Error: function not found

D. Cannot delete posts

Solution

1. Step 1: Understand the condition

   The if checks if the user has 'delete_posts' capability.

2. Step 2: Evaluate the condition result

   If the user cannot delete posts, the condition is false, so the else block runs.

3. Final Answer:

   Cannot delete posts -> Option D

4. Quick Check:

   False condition triggers else = D [OK]

Hint: If user lacks capability, else block runs [OK]

Common Mistakes:

• Assuming output is always 'Can delete posts'
• Confusing capability names
• Expecting errors if capability missing

4. Identify the error in this code snippet:

if (current_user_can('edit_post')) {
  echo 'User can edit post';
}

medium

A. Missing semicolon after echo statement

B. The capability name should be 'edit_posts' not 'edit_post'

C. current_user_can() requires two arguments

D. The function should be called as currentUserCan()

Solution

1. Step 1: Check capability name correctness

   WordPress uses 'edit_posts' (plural) as the capability, not 'edit_post'.

2. Step 2: Verify syntax and function usage

   Semicolon is present, function takes one argument, and function name is correct.

3. Final Answer:

   The capability name should be 'edit_posts' not 'edit_post' -> Option B

4. Quick Check:

   Correct capability string = A [OK]

Hint: Check exact capability names in WordPress docs [OK]

Common Mistakes:

• Using singular instead of plural capability names
• Assuming function needs multiple arguments
• Incorrect function name casing

5. You want to show a special admin menu only to users who can manage options and edit themes. Which code correctly checks both capabilities before showing the menu?

hard

A. if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); }

B. if (current_user_can('manage_options' || 'edit_themes')) { show_menu(); }

C. if (current_user_can(['manage_options', 'edit_themes'])) { show_menu(); }

D. if (current_user_can('manage_options') || current_user_can('edit_themes')) { show_menu(); }

Solution

1. Step 1: Understand logical AND for both capabilities

   To require both permissions, use && between two separate current_user_can() calls.

2. Step 2: Evaluate each option's logic

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } correctly uses && with two calls; A and B misuse syntax; D uses || which allows either permission.

3. Final Answer:

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } -> Option A

4. Quick Check:

   Both capabilities require && = C [OK]

Hint: Use && with separate calls to check multiple capabilities [OK]

Common Mistakes:

• Using || instead of && when both permissions are needed
• Passing multiple capabilities as one argument
• Using incorrect syntax for logical operators