User capability checks in Wordpress - Step-by-Step Execution

Concept Flow - User capability checks

Start: User requests action

↓

Check user logged in?

No→Deny access or redirect

Yes↓

Check user capability with current_user_can()

↓

Allow action

↓

End

This flow shows how WordPress checks if a user is logged in and has the right capability before allowing an action.

Execution Sample

Wordpress

<?php
if ( is_user_logged_in() && current_user_can('edit_posts') ) {
  echo 'You can edit posts.';
} else {
  echo 'Access denied.';
}
?>

This code checks if the user is logged in and can edit posts and shows a message accordingly.

Execution Table

Step	Action	Evaluation	Result
1	Check if user is logged in	User logged in = true	Proceed to capability check
2	Call current_user_can('edit_posts')	User has 'edit_posts' capability = true	Allow action
3	Execute echo 'You can edit posts.'	Output message	Message shown to user
4	End	No more code	Execution stops

💡 Execution stops after showing message based on capability check

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
user_logged_in	unknown	true	true	true
user_can_edit_posts	unknown	unknown	true	true
output_message	empty	empty	'You can edit posts.'	'You can edit posts.'

Key Moments - 2 Insights

Why does the code check if the user is logged in before checking capabilities?

Because capabilities only apply to logged-in users. The execution_table row 1 shows the login check before capability check.

What happens if current_user_can() returns false?

The else branch runs, showing 'Access denied.' as in the execution_table rows 2 and 3 if the condition was false.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of user_can_edit_posts at Step 2?

A false

B true

C unknown

D null

💡 Hint

Check the variable_tracker row for user_can_edit_posts at After Step 2

At which step does the code decide to show 'You can edit posts.'?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at execution_table row 3 where echo is executed

If the user was not logged in, what would happen according to the concept_flow?

A Show 'You can edit posts.' message

B Allow action anyway

C Deny access or redirect

D Skip capability check and continue

💡 Hint

See concept_flow step after 'Check user logged in?' with No branch

Concept Snapshot

Use current_user_can('capability') to check if a logged-in user has permission.
Always check if user is logged in before capability.
If check passes, allow action; else deny or show error.
Common capabilities: 'edit_posts', 'publish_posts', 'manage_options'.
This protects sensitive actions from unauthorized users.

Full Transcript

This lesson shows how WordPress checks if a user can do something using user capability checks. First, WordPress checks if the user is logged in. If not, it denies access or redirects. If logged in, it uses current_user_can() to check if the user has the needed capability, like 'edit_posts'. If yes, the action is allowed and a message is shown. If no, access is denied. The example code checks if the user can edit posts and shows a message accordingly. Variables like user_logged_in and user_can_edit_posts track the state. Key points include always checking login before capabilities and handling both allowed and denied cases. The quizzes test understanding of variable values at steps and flow decisions. This helps keep WordPress sites secure by controlling user permissions carefully.

Practice

1. What is the main purpose of the current_user_can() function in WordPress?

easy

A. To check if the current user has a specific capability

B. To create a new user role

C. To delete a user from the database

D. To update the user's profile information

Solution

1. Step 1: Understand the function's role

   current_user_can() is designed to check permissions for the current user.

2. Step 2: Identify correct usage

   It returns true if the user has the capability passed as an argument, otherwise false.

3. Final Answer:

   To check if the current user has a specific capability -> Option A

4. Quick Check:

   Permission check = A [OK]

Hint: Remember: current_user_can checks permissions, not user creation [OK]

Common Mistakes:

• Confusing capability check with user creation
• Thinking it modifies user data
• Assuming it deletes users

2. Which of the following is the correct syntax to check if the current user can edit posts?

easy

A. current_user_can(edit_posts);

B. current_user_can['edit_posts'];

C. current_user_can('edit_posts');

D. current_user_can->edit_posts();

Solution

1. Step 1: Identify correct function call syntax

   WordPress functions use parentheses and string arguments in quotes.

2. Step 2: Check each option

   Only current_user_can('edit_posts'); uses parentheses and quotes correctly.

3. Final Answer:

   current_user_can('edit_posts'); -> Option C

4. Quick Check:

   Function call with string argument = B [OK]

Hint: Use parentheses and quotes for capability strings [OK]

Common Mistakes:

• Omitting quotes around capability
• Using square brackets instead of parentheses
• Using arrow notation incorrectly

3. What will the following code output if the current user cannot delete posts?

if (current_user_can('delete_posts')) {
  echo 'Can delete posts';
} else {
  echo 'Cannot delete posts';
}

medium

A. Can delete posts

B. No output

C. Error: function not found

D. Cannot delete posts

Solution

1. Step 1: Understand the condition

   The if checks if the user has 'delete_posts' capability.

2. Step 2: Evaluate the condition result

   If the user cannot delete posts, the condition is false, so the else block runs.

3. Final Answer:

   Cannot delete posts -> Option D

4. Quick Check:

   False condition triggers else = D [OK]

Hint: If user lacks capability, else block runs [OK]

Common Mistakes:

• Assuming output is always 'Can delete posts'
• Confusing capability names
• Expecting errors if capability missing

4. Identify the error in this code snippet:

if (current_user_can('edit_post')) {
  echo 'User can edit post';
}

medium

A. Missing semicolon after echo statement

B. The capability name should be 'edit_posts' not 'edit_post'

C. current_user_can() requires two arguments

D. The function should be called as currentUserCan()

Solution

1. Step 1: Check capability name correctness

   WordPress uses 'edit_posts' (plural) as the capability, not 'edit_post'.

2. Step 2: Verify syntax and function usage

   Semicolon is present, function takes one argument, and function name is correct.

3. Final Answer:

   The capability name should be 'edit_posts' not 'edit_post' -> Option B

4. Quick Check:

   Correct capability string = A [OK]

Hint: Check exact capability names in WordPress docs [OK]

Common Mistakes:

• Using singular instead of plural capability names
• Assuming function needs multiple arguments
• Incorrect function name casing

5. You want to show a special admin menu only to users who can manage options and edit themes. Which code correctly checks both capabilities before showing the menu?

hard

A. if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); }

B. if (current_user_can('manage_options' || 'edit_themes')) { show_menu(); }

C. if (current_user_can(['manage_options', 'edit_themes'])) { show_menu(); }

D. if (current_user_can('manage_options') || current_user_can('edit_themes')) { show_menu(); }

Solution

1. Step 1: Understand logical AND for both capabilities

   To require both permissions, use && between two separate current_user_can() calls.

2. Step 2: Evaluate each option's logic

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } correctly uses && with two calls; A and B misuse syntax; D uses || which allows either permission.

3. Final Answer:

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } -> Option A

4. Quick Check:

   Both capabilities require && = C [OK]

Hint: Use && with separate calls to check multiple capabilities [OK]

Common Mistakes:

• Using || instead of && when both permissions are needed
• Passing multiple capabilities as one argument
• Using incorrect syntax for logical operators