In general your problem is that you check the condition on the front end but not on the backend. You have to check if a user is a allowed to upload a file before moving it to the uploads directory and adding it as an attachment.
If the limitation you put are kind of nice to have it might be enough to limit upload in the UI, but if it has business or law related implications then the only way is server side checks.
Related Posts:
- Upload Multiple Files With media_handle_upload
- Adding fields to the “Add New User” screen in the dashboard
- How to get the image EXIF date/time and use it for the WP post date/time
- delete uploaded file
- How to save Uploaded image in custom option panel?
- Authors details such as social media links, emails etc → Is this Meta or something else?
- Max file size not updating
- Allowing SVG uploads in media uploader without plug-in
- Custom image size in Media Dropdown
- Search user metadata with checkboxes via ajax (almost working)
- Images uploaded using media uploader are appearing upside down
- How can I enable uploading excel files?
- Calling a function from anywhere, used in different places
- Can I hide certain upload folders in media library [duplicate]
- WordPress upload_mimes not working for front-end uploads of 3D files
- create shortcode to list users with specific meta key value
- Last Login in number of days format
- Disable auto-resizing of uploaded images, but only for certain filename
- Why is functions.php file in child not initializing and over-writing parent?
- When sale price is 0.00 show only regular price
- Can’t generate thumbnail images
- Update user meta of author when post content is viewed
- is_author(get_current_user_id()) returns false when author id and user id match
- How to get data from an array using get_user_meta()
- Adding an option to a shortcode
- How to stop media_sideload_image from running when deleting a post?
- Possible to hook into Media Library preview File column and use a custom image?
- Need To Change WordPress Meta Tags… Includes wordpress shortcodes
- wp_usermeta – Read from database, but save function broken
- Function to pull data from user meta not working
- User meta and public function security
- Get users with different roles and call function on each of them (user_meta)
- Message notification for user
- Is it possible to limit number of files a non-admin user can upload via the WordPress media library?
- How to add HTML into error message
- Auto copy value from specific user meta field to another field
- Serving cache from multiple domain names
- delete_user_meta for user in spesific group
- restrict uploaded image size and fixed image display size
- Function image_send_to_editor returns emty title tag
- Zip all (original) images from media gallery
- How can I include user meta information in the resulting array of a WP_User_Query?
- Figure inlined width trigger distorted layout
- wp_upload_bits – define (sub)folder / (sub)directory before filename?
- update_usermeta don’t work
- How to Update User Meta Field other than from profile?
- Dynamically Generating User Meta Field
- Rename file after title , one small problem
- When the WP_EDITOR button is pressed, the user is prompted to select a photo from their device
- User’s Comments Number: Storing it in a meta field for different uses
- How to overwrite image if it already exists – WordPress, Gravity form
- Convert Image to Webp on upload without plugin
- Sharing website link shows author name but only on GROUPME
- Missing feature image link function
- What’s the difference between home_url() and site_url()
- Remove “Category:”, “Tag:”, “Author:” from the_archive_title
- get_template_directory_uri pointing to parent theme not child theme
- How to customize the_archive_title()?
- remove empty paragraphs from the_content?
- What is the “with_front” rewrite key?
- Why use if function_exists?
- How to override parent functions in child themes?
- wp_enqueue_script was called incorrectly
- Add multiple custom fields to the general settings page
- Ajax call always returns 0
- 400 bad request on admin-ajax.php only using wp_enqueue_scripts action hook
- How long does a deprecated function live in core?
- Solution to render Shortcodes in Admin Editor
- How to add a data attribute to a WordPress menu item
- What’s the difference between esc_html, esc_attr, esc_html_e, and so on?
- remove_action on after_setup_theme not working from child theme
- plugins_url vs plugin_dir_url
- Remove type attribute from script and style tags added by WordPress
- How to run a function every 5 minutes?
- Best way of passing PHP variable between partials?
- How to display custom field in woocommerce orders in admin panel?
- Issues with title-tag and document_title_parts
- How do I get the current edit page ID in the admin?
- How to check if a user exists by a given id
- Why isn’t is_page working when I put it in the functions.php file?
- Add tags to the section via functions.php
- Add image size if page template
- How to create a custom order status in woocommerce!
- Remove Actions/Filters added via Anonymous Functions
- Adding a second email address to a completed order in WooCommerce [closed]
- How to load parent_theme functions.php before child_theme?
- How to load scripts/styles specific for a page
- Programatically add options to “add new” custom field dropdown
- Is there any global functions.php file which works for any theme?
- Excluding iPad from wp_is_mobile
- When should you, and when should you not, use wp_list_pluck()?
- Get the ID of the page a menu item links to?
- Add container to nav_menu sub menu
- Difference between the_permalink() and get_permalink() function
- What’s the difference between WordPress random_int() and PHP built-in function random_int()?
- Child theme – Overriding ‘require_once’ in functions.php
- Link to user’s profile settings page?
- WordPress Enqueue for homepage only, functions.php, wp-framework
- get php variable from functions php and echo it in theme template files [closed]
- Get menu object from theme_location