Roles and Capabilities
The user system in the WordPress has built in roles and capabilities system which helps us define that user will have access to which part of the site and what actions a particular user is allowed to perform.
By default WordPress has 6 user roles
- Super Admin
- Administrator
- Editor
- Author
- Contributor
- Subscriber
Now all these user roles comes with their own set of capabilities, which are stored under the options table named wp_user_roles.
The roles and capabilities are
Array
(
[administrator] => Array
(
[name] => Administrator
[capabilities] => Array
(
[switch_themes] => 1
[edit_themes] => 1
[activate_plugins] => 1
[edit_plugins] => 1
[edit_users] => 1
[edit_files] => 1
[manage_options] => 1
[moderate_comments] => 1
[manage_categories] => 1
[manage_links] => 1
[upload_files] => 1
[import] => 1
[unfiltered_html] => 1
[edit_posts] => 1
[edit_others_posts] => 1
[edit_published_posts] => 1
[publish_posts] => 1
[edit_pages] => 1
[read] => 1
[level_10] => 1
[level_9] => 1
[level_8] => 1
[level_7] => 1
[level_6] => 1
[level_5] => 1
[level_4] => 1
[level_3] => 1
[level_2] => 1
[level_1] => 1
[level_0] => 1
[edit_others_pages] => 1
[edit_published_pages] => 1
[publish_pages] => 1
[delete_pages] => 1
[delete_others_pages] => 1
[delete_published_pages] => 1
[delete_posts] => 1
[delete_others_posts] => 1
[delete_published_posts] => 1
[delete_private_posts] => 1
[edit_private_posts] => 1
[read_private_posts] => 1
[delete_private_pages] => 1
[edit_private_pages] => 1
[read_private_pages] => 1
[delete_users] => 1
[create_users] => 1
[unfiltered_upload] => 1
[edit_dashboard] => 1
[update_plugins] => 1
[delete_plugins] => 1
[install_plugins] => 1
[update_themes] => 1
[install_themes] => 1
[update_core] => 1
[list_users] => 1
[remove_users] => 1
[promote_users] => 1
[edit_theme_options] => 1
[delete_themes] => 1
[export] => 1
)
)
[editor] => Array
(
[name] => Editor
[capabilities] => Array
(
[moderate_comments] => 1
[manage_categories] => 1
[manage_links] => 1
[upload_files] => 1
[unfiltered_html] => 1
[edit_posts] => 1
[edit_others_posts] => 1
[edit_published_posts] => 1
[publish_posts] => 1
[edit_pages] => 1
[read] => 1
[level_7] => 1
[level_6] => 1
[level_5] => 1
[level_4] => 1
[level_3] => 1
[level_2] => 1
[level_1] => 1
[level_0] => 1
[edit_others_pages] => 1
[edit_published_pages] => 1
[publish_pages] => 1
[delete_pages] => 1
[delete_others_pages] => 1
[delete_published_pages] => 1
[delete_posts] => 1
[delete_others_posts] => 1
[delete_published_posts] => 1
[delete_private_posts] => 1
[edit_private_posts] => 1
[read_private_posts] => 1
[delete_private_pages] => 1
[edit_private_pages] => 1
[read_private_pages] => 1
)
)
[author] => Array
(
[name] => Author
[capabilities] => Array
(
[upload_files] => 1
[edit_posts] => 1
[edit_published_posts] => 1
[publish_posts] => 1
[read] => 1
[level_2] => 1
[level_1] => 1
[level_0] => 1
[delete_posts] => 1
[delete_published_posts] => 1
)
)
[contributor] => Array
(
[name] => Contributor
[capabilities] => Array
(
[edit_posts] => 1
[read] => 1
[level_1] => 1
[level_0] => 1
[delete_posts] => 1
)
)
[subscriber] => Array
(
[name] => Subscriber
[capabilities] => Array
(
[read] => 1
[level_0] => 1
)
)
)
If we take a look at this we will find that the capabilities are defined as slugs with the value as 1 or 0 -> Here 1 means allowed -> 0 means not allowed
All of this work flow is handled through the WP_Roles class under includes/class-wp-roles.php
Adding a capability to a user role
We can easily add a capability to an existing user role using the function add_cap from the WP_Roles class which can be access using the global $wp_roles variable
global $wp_roles;
$wp_roles->add_cap( 'administrator', 'custom_capability', true );This would add the capability to the administrator role :
Now if we pass the third parameter as false it would add the capability but as 0
global $wp_roles;
$wp_roles->add_cap( 'administrator',
'custom_capability', false );
Remove a capability from a user role
We can also easily remove the capability from an existing user role using the function remove_cap of the WP_Roles class which can be also accessed using the global $wp_roles variable
global $wp_roles;
$wp_roles->remove_cap( 'administrator', 'custom_capability' );In this we just need to send two parameters, role name and the capability name
is_role( $name ) -> This would check if the supplied role name exists or not
File Header API
The file header API is used by WordPress to get the file header data so it can be used or checked in our PHP code
For example -> Getting the Plugin Header data
There are several functions inside the File Header API
- get_plugin_data() -> This function is used to get the header information of the plugin file, the plugins main file should be provided as the first argument of this function. The data we get from this is the array format.
This function internally uses the get_file_data function to get the data from the plugin file.
- get_theme_data() -> This function is used to get the header of the theme file. This is now deprecated and now wp_get_theme() is used instead of this. This function uses the class WP_Theme which also uses the function get_file_data() internally to fetch the header data.
- get_file_data() -> This function loads the content of the file via file_get_contents and then internally clubs the headers via regex query as key => value pairs and it only searches for the headers sent as $default_headers and from the filter
extra_{$context}_headers
Here the $context is sent via the function argument.