In general your problem is that you check the condition on the front end but not on the backend. You have to check if a user is a allowed to upload a file before moving it to the uploads directory and adding it as an attachment.
If the limitation you put are kind of nice to have it might be enough to limit upload in the UI, but if it has business or law related implications then the only way is server side checks.
Related Posts:
- Upload Multiple Files With media_handle_upload
- Adding fields to the “Add New User” screen in the dashboard
- How to get the image EXIF date/time and use it for the WP post date/time
- delete uploaded file
- How to save Uploaded image in custom option panel?
- Authors details such as social media links, emails etc → Is this Meta or something else?
- Max file size not updating
- Allowing SVG uploads in media uploader without plug-in
- Custom image size in Media Dropdown
- Search user metadata with checkboxes via ajax (almost working)
- Images uploaded using media uploader are appearing upside down
- How can I enable uploading excel files?
- Calling a function from anywhere, used in different places
- Can I hide certain upload folders in media library [duplicate]
- WordPress upload_mimes not working for front-end uploads of 3D files
- create shortcode to list users with specific meta key value
- Last Login in number of days format
- Disable auto-resizing of uploaded images, but only for certain filename
- Why is functions.php file in child not initializing and over-writing parent?
- When sale price is 0.00 show only regular price
- Can’t generate thumbnail images
- Update user meta of author when post content is viewed
- is_author(get_current_user_id()) returns false when author id and user id match
- How to get data from an array using get_user_meta()
- Adding an option to a shortcode
- How to stop media_sideload_image from running when deleting a post?
- Possible to hook into Media Library preview File column and use a custom image?
- Need To Change WordPress Meta Tags… Includes wordpress shortcodes
- wp_usermeta – Read from database, but save function broken
- Function to pull data from user meta not working
- User meta and public function security
- Get users with different roles and call function on each of them (user_meta)
- Message notification for user
- Is it possible to limit number of files a non-admin user can upload via the WordPress media library?
- How to add HTML into error message
- Auto copy value from specific user meta field to another field
- Serving cache from multiple domain names
- delete_user_meta for user in spesific group
- restrict uploaded image size and fixed image display size
- Function image_send_to_editor returns emty title tag
- Zip all (original) images from media gallery
- How can I include user meta information in the resulting array of a WP_User_Query?
- Figure inlined width trigger distorted layout
- wp_upload_bits – define (sub)folder / (sub)directory before filename?
- update_usermeta don’t work
- How to Update User Meta Field other than from profile?
- Dynamically Generating User Meta Field
- Rename file after title , one small problem
- When the WP_EDITOR button is pressed, the user is prompted to select a photo from their device
- User’s Comments Number: Storing it in a meta field for different uses
- How to overwrite image if it already exists – WordPress, Gravity form
- Convert Image to Webp on upload without plugin
- What’s the difference between esc_html, esc_attr, esc_html_e, and so on?
- Is there a hook or function I can use to display all theme files being used on a current page?
- How can I remove the title “leave a reply” in the comment box in twentyeleven?
- Check if has any sidebar active on current page
- Login using the password from protected pages
- Remove tag on my RSS Feed
- Automated mark posts as featured every day
- Enqueuing External Javascript functions.php
- Child Theme Not Overriding Parent Theme
- Function to wrap the_content in a div
- How to run a function once on every post in database?
- Date/time limitation of posts where function must be executed
- Trouble using antispambot()
- Post Pagination Showing Same Posts Every Page
- How to filter a table in post content without plugins? [closed]
- Having issues with a foreach inside of a shortcode with ACF gallery
- Word Press – Dynamic Content [closed]
- Change label for registration Fields
- Warning: : DOMDocument::loadHTML(): Empty string supplied as input in functions.php when adding classes to post images
- Remove stylesheets from Campaign Monitor plugin
- Categories as main menu items and subcategories as nested lists
- woocommerce change currency per category [closed]
- I can’t enqueue my scripts – They literally aren’t being added to my site
- Using wp_redirect and .htaccess to re-route searches (and pass along the remaining GET vars)
- Make wp_link_pages() suitable for Twitter Bootstrap markup
- laoding bloginfo url in function array?
- How to edit classes in body tag?
- Add a field into a shortcode of an extension
- Need a method to prevent WP from adding in between my shortcodes
- How to edit/replace Parent functions.php function in Child Theme to add “Walker” class
- Load scripts for do_shortcode( ‘ [ my_shortcode ] ‘ )
- How to modify get_the_excerpt() when post-format equals ‘quote’?
- How to print the current post depth as update notification?
- How to safely edit functions.php
- Linking Javascript in functions.php file
- Enqueueing scripts selectively & activation where needed
- Using One Function To Create Two Different Shortcodes
- Change Page Title
- Put images in the media from url functions
- Paragraph spaces in email template function
- Including Font Awesome in a Custom Theme
- How would I correctly implement a new if statement in a child functions file?
- How To Show Shortcodes In WordPress Custom Fields?
- Language Switch Function
- How to debug function file causing white screen
- Load CSS conditional on custom field is present
- Modify sub_menu function to show pages below a specifically set page
- Add custom class to all URLs on entire site