Here are 2 methods: Method 1: Remove the upload_files capability from the respective roles. e.g. removing it from author: $role = get_role( ‘author’ ); $role->remove_cap( ‘upload_files’ ); This is saved to the database so it should only happen once, not on every page load. Removing it from the editor role should be the same albeit … Read more
Here’s the code from wp-admin/includes/file.php: if ( ! $method && function_exists(‘getmyuid’) && function_exists(‘fileowner’) ){ if ( !$context ) $context = WP_CONTENT_DIR; // If the directory doesn’t exist (wp-content/languages) then use the parent directory // as we’ll create it. if ( WP_LANG_DIR == $context && ! is_dir( $context ) ) $context = dirname( $context ); $context … Read more
The problem, as the error description indicates, is permissions. Based on that tutorial, nginx is running under the www-data user, but WP folders are owned by deployer. If you change the ownership of your $WP_ROOT to www-data:www-data, you will find that you can update your WP. I’m not amazing at security, so there may be … Read more
I found the problem. In settings > media the folder for uploads was actually pointing to a different path. Once I redirected it to wp-content/uploads it all worked.
Do not point the URL to admin.php, use admin-post.php instead: ‘<a href=”‘ . admin_url( ‘admin-post.php?action=print.csv’ ) . ‘”>’ In your plugin register a callback for that action: add_action( ‘admin_post_print.csv’, ‘print_csv’ ); function print_csv() { if ( ! current_user_can( ‘manage_options’ ) ) return; header(‘Content-Type: application/csv’); header(‘Content-Disposition: attachment; filename=example.csv’); header(‘Pragma: no-cache’); // output the CSV data } … Read more
A base WordPress installation probably won’t do what you want it to. You could set up a multi-site instance and allow users to have their own ‘sub’ site, or use something like BuddyPress or Mingle that has a user profile feature.
Don’t let the action die, just do a redirect (to wherever you’d like): function wpse_92155_before_delete_post() { wp_redirect(admin_url(‘edit.php’)); exit(); } // function wpse_92155_before_delete_post add_action(‘before_delete_post’, ‘wpse_92155_before_delete_post’, 1);
The only prerequisite for current_user_can() is an existing wp_get_current_user(). The latter is defined in pluggable.php, so you can use it after plugins_loaded. The _doing_it_wrong() call you are citing in your question is wrong for itself. My guess is that you took that from BuddyPress or bbPress. Both are running into a recursion if they don’t … Read more
I got this almost working, but refinements are needed to fit the specifics of the question and to deal with Attachments and Post-Types differently (see comments in code)… First, I think it’s worth noting how I found the filter: apply_filters( ‘views_’ . $screen->id, $views ) inspect element do a global search in /wp-admin and /wp-includes … Read more
If you did want to lock things down…. a normal wordpress site will usually only require the database user to have SELECT, INSERT, UPDATE and DELETE. If you want to use the automatic update feature it will also require CREATE and ALTER. Some plugins may require other permissions but most won’t.