members / inc / template.php

template.php in Members – Membership & User Role Editor Plugin 3.2.24, at inc/template.php

166 lines 5.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Template-related functions for theme authors.
4	*
5	* @package Members
6	* @subpackage Includes
7	* @author The MemberPress Team
8	* @copyright Copyright (c) 2009 - 2018, The MemberPress Team
9	* @link https://members-plugin.com/
10	* @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
11	*/
12	if (!defined('ABSPATH')) {
13	die('You are not allowed to call this page directly.');
14	}
15
16	/**
17	* Conditional tag to check if a user can view a specific post. A user cannot view a post if their
18	* user role has not been selected in the 'Content Permissions' meta box on the edit post screen in
19	* the admin. Non-logged in site visitors cannot view posts if roles were selected. If no roles
20	* were selected, all users and site visitors can view the content.
21	*
22	* There are exceptions to this rule though. The post author, any user with the `restrict_content`
23	* capability, and users that have the ability to edit the post can always view the post, even if
24	* their role was not granted permission to view it.
25	*
26	* @since 0.2.0
27	* @access public
28	* @param int $user_id
29	* @param int $post_id
30	* @return bool
31	*/
32	function members_can_user_view_post( $user_id, $post_id = '' ) {
33
34	// If no post ID is given, assume we're in The Loop and get the current post's ID.
35	if ( ! $post_id ) {
36	$post_id = get_the_ID();
37	}
38
39	// Get post object.
40	$post = get_post( $post_id );
41
42	// Assume the user can view the post at this point. */
43	$can_view = true;
44
45	// The plugin is only going to handle permissions if the 'content permissions' feature
46	// is active. If not active, the user can always view the post. However, developers
47	// can roll their own handling of this and filter `members_can_user_view_post`.
48	if ( $post instanceof \WP_Post && members_content_permissions_enabled() ) {
49
50	// Get the roles selected by the user.
51	$roles = members_get_post_roles( $post_id );
52
53	// Check if there are any old roles with the '_role' meta key.
54	if ( empty( $roles ) )
55	$roles = members_convert_old_post_meta( $post_id );
56
57	// If we have an array of roles, let's get to work.
58	if ( ! empty( $roles ) && is_array( $roles ) ) {
59
60	// Since specific roles were given, let's assume the user can't view
61	// the post at this point. The rest of this functionality should try
62	// to disprove this.
63	$can_view = false;
64
65	// Get the post type object.
66	$post_type = get_post_type_object( $post->post_type );
67
68	// If viewing a feed or if the user's not logged in, assume it's blocked at this point.
69	if ( is_feed() \|\| ! is_user_logged_in() ) {
70	$can_view = false;
71	}
72
73	// If the post author, the current user can edit the post, or the current user can 'restrict_content', return true.
74	elseif ( $post->post_author == $user_id \|\| user_can( $user_id, 'restrict_content' ) \|\| user_can( $user_id, $post_type->cap->edit_post, $post_id ) ) {
75	$can_view = true;
76	}
77
78	// Else, let's check the user's role against the selected roles.
79	else {
80
81	// Loop through each role and set $can_view to true if the user has one of the roles.
82	foreach ( $roles as $role ) {
83
84	if ( members_user_has_role( $user_id, $role ) ) {
85	$can_view = true;
86	break;
87	}
88	}
89	}
90	}
91	}
92
93	// Set the check for the parent post based on whether we have permissions for this post.
94	$check_parent = empty( $roles ) && $can_view;
95
96	// Set to `FALSE` to avoid hierarchical checking.
97	if ( apply_filters( 'members_check_parent_post_permission', $check_parent, $post_id, $user_id ) ) {
98
99	if ( $post instanceof \WP_Post ) {
100
101	$parent_id = $post->post_parent;
102
103	// If the post has a parent, check if the user has permission to view it.
104	if ( 0 < $parent_id ) {
105	$can_view = members_can_user_view_post( $user_id, $parent_id );
106	}
107	}
108	}
109
110	// Allow developers to overwrite the final return value.
111	return apply_filters( 'members_can_user_view_post', $can_view, $user_id, $post_id );
112	}
113
114	/**
115	* Wrapper function for the members_can_user_view_post() function. This function checks if the
116	* currently logged-in user can view the content of a specific post.
117	*
118	* @since 0.2.0
119	* @access public
120	* @param int $post_id
121	* @return bool
122	*/
123	function members_can_current_user_view_post( $post_id = '' ) {
124
125	return members_can_user_view_post( get_current_user_id(), $post_id );
126	}
127
128	/**
129	* Function for listing users like the WordPress function currently uses for authors.
130	*
131	* @link http://core.trac.wordpress.org/ticket/15145
132	* @since 0.1.0
133	* @access public
134	* @param array $args
135	* @return string
136	*/
137	function members_list_users( $args = array() ) {
138
139	$output = '';
140	$users = get_users( $args );
141
142	if ( ! empty( $users ) ) {
143
144	foreach ( $users as $user ) {
145
146	$url = get_author_posts_url( $user->ID, $user->user_nicename );
147
148	$class = sanitize_html_class( "user-{$user->ID}" );
149
150	if ( is_author( $user->ID ) )
151	$class .= ' current-user';
152
153	$output .= sprintf( '<li class="%s"><a href="%s">%s</a></li>', esc_attr( $class ), esc_url( $url ), esc_html( $user->display_name ) );
154	}
155
156	$output = sprintf( '<ul class="xoxo members-list-users">%s</ul>', $output );
157	}
158
159	$output = apply_filters( 'members_list_users', $output );
160
161	if ( empty( $args['echo'] ) )
162	return $output;
163
164	echo $output;
165	}
166