Not sure i understand why you’d want to query by ID, but that said it’s possible in a hacky kind of way(i like this method because it’s simple). add_action( ‘parse_request’, ‘idsearch’ ); function idsearch( $wp ) { global $pagenow; // If it’s not the post listing return if( ‘edit.php’ != $pagenow ) return; // If … Read more
current_user_can will accept a role name but, sadly, the behavior with roles is not entirely consistent. The following should work and is simpler than what you have, by a little bit. $current_user = wp_get_current_user(); if (user_can( $current_user, ‘administrator’ )) { // user is an admin }
If you want to test your custom SQL to see how it affects the loading time, you can try this query swapping: /** * Restrict the potential slow query in the meta_form() to the current post ID. * * @see http://wordpress.stackexchange.com/a/187712/26350 */ add_action( ‘add_meta_boxes_post’, function( $post ) { add_filter( ‘query’, function( $sql ) use ( … Read more
I think a better implementation would be a “message” class e.g.: class WPSE_224485_Message { private $_message; function __construct( $message ) { $this->_message = $message; add_action( ‘admin_notices’, array( $this, ‘render’ ) ); } function render() { printf( ‘<div class=”updated”>%s</div>’, $this->_message ); } } This allows you to instantiate the message at any time prior to rendering: … Read more
jQuery / JavaScript in the footer One thing you can do is to move jQuery to the footer blog post. It’s per default not needed in the header. You will have check if everything still works tough, as I normally just do that for themes: <?php /* Plugin Name: Move jQuery to the footer */ … Read more
To lock subscribers and contributors out of the admin: function wpse23007_redirect(){ if( is_admin() && !defined(‘DOING_AJAX’) && ( current_user_can(‘subscriber’) || current_user_can(‘contributor’) ) ){ wp_redirect(home_url()); exit; } } add_action(‘init’,’wpse23007_redirect’); Hope that helps. All roles give the user a capability that is the name of that role, so you can use any role name as a capability.
The correct hook to use is admin_menu and then create a function to remove the menus you want to remove. The following 2 functions remove all the menus. add_action( ‘admin_menu’, ‘remove_admin_menus’ ); add_action( ‘admin_menu’, ‘remove_admin_submenus’ ); //Remove top level admin menus function remove_admin_menus() { remove_menu_page( ‘edit-comments.php’ ); remove_menu_page( ‘link-manager.php’ ); remove_menu_page( ‘tools.php’ ); remove_menu_page( ‘plugins.php’ … Read more
admin-ajax.php is part of the WordPress AJAX API, and yes, it does handle requests from both backend and front. Try not to worry about the fact that it is in wp-admin. I think that is a strange place for it too, but it is not a security problem in itself. How this relates to “enumerate … Read more
You need just two steps: Hook into the action admin_menu, register the page with a callback function to print the content. In your callback function load the file from plugin_dir_path( __FILE__ ) . “included.html”. Demo code: add_action( ‘admin_menu’, ‘wpse_91693_register’ ); function wpse_91693_register() { add_menu_page( ‘Include Text’, // page title ‘Include Text’, // menu title ‘manage_options’, … Read more
You can’t pull it in wp-admin you actually have to go look at the plugin in wordpress repository and see if they added there or to the plugin author’s site for a changelog. That would be a nice feature for the future.