is there a way to make sure that a shortcode can be used only by certain userroles?

You could filter the content when the post is saved and if the user doesn't
have the right permissions, then I strip the shortcode or present a warning.

you could try using
http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre,
then maybe some regex to find the shortcode and strip it out

Post by Haluk Karamete
What I mean by that is that is this...
let's say there is an admin-editors-only shortcode. let's call it "xyx"
shortcode for the sake of an example.
is it possible to have a contributor or author to not to be able to use
that shortcode? they all get stopped with a warning that the post cannot be
saved (or created) because it contains the "xyx" shortcode!
to cover all the possibilities (such as posting thru email, or thru some
other esoteric ways) , what is the best hook(s) that I need to watch out so
that there are no loop holes left...
I hope it was clear and did not confuse you...
thank you
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers

--
thanks

*jesse friedman*
jes.se.com
Book: Web Designers Guide to WordPress -
http://wdgwp.com/onamazon<http://wdgwp.com/onamazon>
Twitter: @professor <http://twitter.com/professor>
Facebook: Like<https://www.facebook.com/pages/Jesse-Friedman/204793299545174>

Nikola Nikolov

2013-11-12 21:42:19 UTC

Since the regex that matches shortcodes is quite complex, I can suggest to
you the following VERY ugly hack :)

function filter_out_protected_shortcode( $content ) {
// Check to see if the current user can or can't do a specific task
// it would probably be different in your case
if ( ! current_user_can( 'edit_others_posts' ) ) {
global $shortcode_tags;
// Back-up the currently registered shortcodes
$_sc_tags = $shortcode_tags;

// Change the shortcode's handler to return an empty string instead of the
actual content
$shortcode_tags = array( 'xyx' => '__return_empty_string' );

// Now, since we overrided the $shortcode_tags variable
// Only the [xyx] shortcode will be parsed - and it will be replaced
// with an empty string :)
$content = do_shortcode( $content );

// Restore the original shortcode handlers
$shortcode_tags = $_sc_tags;
}

return $content;
}
add_filter( 'content_save_pre', 'filter_out_protected_shortcode', 10 );

So what happens here is that we hook to the "content_save_pre" filter as
Jesse suggested.
We then check if the user can use that shortcode. If they can't, we
override the global $shortcode_tags variable to only contain our shortcode
with a callback "__return_empty_string" - which as the name suggests
returns an empty string.
After that, we parse the content and if the shortcode was found there - it
will be replaced with an empty string.

This is not a perfect solution, since if the shortcode was surrounded by
two empty lines(one before and one after), you would get three empty lines.

I haven't tested that code, but it should in theory work.

Also - the chances are that no shortcodes would be parsed for that
request(since that's a request for updating/saving a post) and you can skip
the copying/restoring of the $shortcode_tags variable, but I always prefer
to put things back together the way I found them, than to leave them
messy(debugging something like that is a pain).

Well, that's about it - it's an UGLY hack, but I believe that the core
handling of the shortcodes is better than anything that I would come-up
regex-wise(and I'm generally somewhat decent in writing those).

On Tue, Nov 12, 2013 at 10:08 PM, Jesse Friedman <

Post by Jesse Friedman
You could filter the content when the post is saved and if the user doesn't
have the right permissions, then I strip the shortcode or present a warning.
you could try using
http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre,
then maybe some regex to find the shortcode and strip it out

Post by Haluk Karamete
saved (or created) because it contains the "xyx" shortcode!
to cover all the possibilities (such as posting thru email, or thru some
other esoteric ways) , what is the best hook(s) that I need to watch out

Post by Haluk Karamete
that there are no loop holes left...
I hope it was clear and did not confuse you...
thank you
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers

--
thanks
*jesse friedman*
jes.se.com
Book: Web Designers Guide to WordPress -
http://wdgwp.com/onamazon<http://wdgwp.com/onamazon>
Facebook: Like<
https://www.facebook.com/pages/Jesse-Friedman/204793299545174>
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers

John

2013-11-13 14:46:24 UTC

has_shortcode was introduced in 3.6.0. You might find that useful here.

Post by Nikola Nikolov
Since the regex that matches shortcodes is quite complex, I can suggest to
you the following VERY ugly hack :)
function filter_out_protected_shortcode( $content ) {
// Check to see if the current user can or can't do a specific task
// it would probably be different in your case
if ( ! current_user_can( 'edit_others_posts' ) ) {
global $shortcode_tags;
// Back-up the currently registered shortcodes
$_sc_tags = $shortcode_tags;
// Change the shortcode's handler to return an empty string instead of the
actual content
$shortcode_tags = array( 'xyx' => '__return_empty_string' );
// Now, since we overrided the $shortcode_tags variable
// Only the [xyx] shortcode will be parsed - and it will be replaced
// with an empty string :)
$content = do_shortcode( $content );
// Restore the original shortcode handlers
$shortcode_tags = $_sc_tags;
}
return $content;
}
add_filter( 'content_save_pre', 'filter_out_protected_shortcode', 10 );
So what happens here is that we hook to the "content_save_pre" filter as
Jesse suggested.
We then check if the user can use that shortcode. If they can't, we
override the global $shortcode_tags variable to only contain our shortcode
with a callback "__return_empty_string" - which as the name suggests
returns an empty string.
After that, we parse the content and if the shortcode was found there - it
will be replaced with an empty string.
This is not a perfect solution, since if the shortcode was surrounded by
two empty lines(one before and one after), you would get three empty lines.
I haven't tested that code, but it should in theory work.
Also - the chances are that no shortcodes would be parsed for that
request(since that's a request for updating/saving a post) and you can skip
the copying/restoring of the $shortcode_tags variable, but I always prefer
to put things back together the way I found them, than to leave them
messy(debugging something like that is a pain).
Well, that's about it - it's an UGLY hack, but I believe that the core
handling of the shortcodes is better than anything that I would come-up
regex-wise(and I'm generally somewhat decent in writing those).
On Tue, Nov 12, 2013 at 10:08 PM, Jesse Friedman <

Post by Jesse Friedman
You could filter the content when the post is saved and if the user

doesn't

Post by Jesse Friedman
have the right permissions, then I strip the shortcode or present a warning.
you could try using
http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre,
then maybe some regex to find the shortcode and strip it out

cannot

Post by Jesse Friedman
be

Post by Haluk Karamete
saved (or created) because it contains the "xyx" shortcode!
to cover all the possibilities (such as posting thru email, or thru

some

Post by Haluk Karamete
other esoteric ways) , what is the best hook(s) that I need to watch

out

Post by Jesse Friedman
so

_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers

Haluk Karamete

2013-11-13 14:53:06 UTC

Thank you all. It looks like for 3.6 and up, my arsenal would be

content_save_pre<http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>
&
has_shortcode.

Just to make sure... would the above 2 cover all the basis?

What I care the most is the
content_save_pre<http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>
section.
The key question is;

Are all POSTS & PAGES & CPTS go thru
content_save_pre<http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>?
Or
better put;

Is there a way to save a post or page without going thru the
content_save_pre<http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>
?

Post by John
has_shortcode was introduced in 3.6.0. You might find that useful here.

Post by Nikola Nikolov
Since the regex that matches shortcodes is quite complex, I can suggest

Post by Nikola Nikolov
you the following VERY ugly hack :)
function filter_out_protected_shortcode( $content ) {
// Check to see if the current user can or can't do a specific task
// it would probably be different in your case
if ( ! current_user_can( 'edit_others_posts' ) ) {
global $shortcode_tags;
// Back-up the currently registered shortcodes
$_sc_tags = $shortcode_tags;
// Change the shortcode's handler to return an empty string instead of

the

Post by Nikola Nikolov
actual content
$shortcode_tags = array( 'xyx' => '__return_empty_string' );
// Now, since we overrided the $shortcode_tags variable
// Only the [xyx] shortcode will be parsed - and it will be replaced
// with an empty string :)
$content = do_shortcode( $content );
// Restore the original shortcode handlers
$shortcode_tags = $_sc_tags;
}
return $content;
}
add_filter( 'content_save_pre', 'filter_out_protected_shortcode', 10 );
So what happens here is that we hook to the "content_save_pre" filter as
Jesse suggested.
We then check if the user can use that shortcode. If they can't, we
override the global $shortcode_tags variable to only contain our

shortcode

Post by Nikola Nikolov
with a callback "__return_empty_string" - which as the name suggests
returns an empty string.
After that, we parse the content and if the shortcode was found there -

Post by Nikola Nikolov
will be replaced with an empty string.
This is not a perfect solution, since if the shortcode was surrounded by
two empty lines(one before and one after), you would get three empty

lines.

Post by Nikola Nikolov
I haven't tested that code, but it should in theory work.
Also - the chances are that no shortcodes would be parsed for that
request(since that's a request for updating/saving a post) and you can

skip

Post by Nikola Nikolov
the copying/restoring of the $shortcode_tags variable, but I always

prefer

Post by Nikola Nikolov
to put things back together the way I found them, than to leave them
messy(debugging something like that is a pain).
Well, that's about it - it's an UGLY hack, but I believe that the core
handling of the shortcodes is better than anything that I would come-up
regex-wise(and I'm generally somewhat decent in writing those).
On Tue, Nov 12, 2013 at 10:08 PM, Jesse Friedman <

Post by Jesse Friedman
You could filter the content when the post is saved and if the user

doesn't

Post by Jesse Friedman
have the right permissions, then I strip the shortcode or present a warning.
you could try using

http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre,

Post by Jesse Friedman
then maybe some regex to find the shortcode and strip it out
On Tue, Nov 12, 2013 at 2:57 PM, Haluk Karamete <

Post by Haluk Karamete
What I mean by that is that is this...
let's say there is an admin-editors-only shortcode. let's call it

"xyx"

Post by Haluk Karamete
shortcode for the sake of an example.
is it possible to have a contributor or author to not to be able to

use

Post by Haluk Karamete
that shortcode? they all get stopped with a warning that the post

cannot

Post by Jesse Friedman
be

Post by Haluk Karamete
saved (or created) because it contains the "xyx" shortcode!
to cover all the possibilities (such as posting thru email, or thru

some

Post by Haluk Karamete
other esoteric ways) , what is the best hook(s) that I need to watch

out

Post by Jesse Friedman
so

_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers

Nikola Nikolov

2013-11-13 15:34:27 UTC

There's a way to do that if you're using a custom function that directly
queries the database(I hope no one ever does that for normal content :) ).
If you are using wp_insert_post() or wp_update_post() - then the filter
will be applied to the content.

Are you planning on displaying some kind of a notice when you detect the
presence of the shortcode or are you still going to remove the shortcode?
If you're still going to remove the shortcode, then my suggestion would
save you one regex call(since has_shortcode() is almost the same as
do_shortcode(), except for it doesn't convert the shortcode tags to their
proper content).

Post by Haluk Karamete
Thank you all. It looks like for 3.6 and up, my arsenal would be
content_save_pre<
http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>
&
has_shortcode.
Just to make sure... would the above 2 cover all the basis?
What I care the most is the
content_save_pre<
http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>
section.
The key question is;
Are all POSTS & PAGES & CPTS go thru
content_save_pre<
http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>?
Or
better put;
Is there a way to save a post or page without going thru the
content_save_pre<
http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre>
?

Post by John
has_shortcode was introduced in 3.6.0. You might find that useful here.

Post by Nikola Nikolov
Since the regex that matches shortcodes is quite complex, I can suggest

the

Post by John

Post by Nikola Nikolov
Jesse suggested.
We then check if the user can use that shortcode. If they can't, we
override the global $shortcode_tags variable to only contain our

shortcode

Post by Nikola Nikolov
with a callback "__return_empty_string" - which as the name suggests
returns an empty string.
After that, we parse the content and if the shortcode was found there -

Post by Nikola Nikolov
will be replaced with an empty string.
This is not a perfect solution, since if the shortcode was surrounded

Post by John

Post by Nikola Nikolov
two empty lines(one before and one after), you would get three empty

lines.

skip

Post by Nikola Nikolov
the copying/restoring of the $shortcode_tags variable, but I always

prefer

Post by Jesse Friedman
You could filter the content when the post is saved and if the user

doesn't

Post by Jesse Friedman
have the right permissions, then I strip the shortcode or present a warning.
you could try using

http://codex.wordpress.org/Plugin_API/Filter_Reference/content_save_pre,

Post by Jesse Friedman
then maybe some regex to find the shortcode and strip it out
On Tue, Nov 12, 2013 at 2:57 PM, Haluk Karamete <

Post by Haluk Karamete
What I mean by that is that is this...
let's say there is an admin-editors-only shortcode. let's call it

"xyx"

Post by Haluk Karamete
shortcode for the sake of an example.
is it possible to have a contributor or author to not to be able to

use

Post by Haluk Karamete
that shortcode? they all get stopped with a warning that the post

cannot

Post by Jesse Friedman
be

Post by Haluk Karamete
saved (or created) because it contains the "xyx" shortcode!
to cover all the possibilities (such as posting thru email, or thru

some