security - Getting a List of Currently Available Roles on a WordPress Site?

admin管理员组

文章数量:1200372

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of roles that exist on the site to use in the option. Because custom roles can be created we cannot assume the default roles are the only ones available.

What is the best way to fetch the list?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of roles that exist on the site to use in the option. Because custom roles can be created we cannot assume the default roles are the only ones available.

What is the best way to fetch the list?

• security
• users
• capabilities
• user-roles

Share Improve this question edited Sep 11, 2010 at 23:09 MikeSchinkel 37.5k1414 gold badges116116 silver badges132132 bronze badges asked Sep 11, 2010 at 19:38 jerclarkejerclarke 3,07322 gold badges2828 silver badges3535 bronze badges 2

• 6 Note: This question was originally asked by Ryan Bilesky on the wp-hackers mailing list and answered by me. I added it here because it's a clear case of best-practice question that people might ask google :) – jerclarke Commented Sep 11, 2010 at 19:42
• 1 Hey @Jeremy Clarke - Really glad to have your participation here and these are exactly the types of things we are looking for here; answers related to common questions that can also reveal best practices. Kudos! – MikeSchinkel Commented Sep 11, 2010 at 23:07

Add a comment  | 

6 Answers 6

Sorted by: Reset to default 63

Roles are stored in the global variable $wp_roles.

The ideal function is get_editable_roles() from /wp-admin/includes/user.php

function get_editable_roles() {
    global $wp_roles;

    $all_roles = $wp_roles->roles;
    $editable_roles = apply_filters('editable_roles', $all_roles);

    return $editable_roles;
}

The "editable" part is because it offers other plugins a chance to filter the list in case someone other than admin has 'edit_users' privilege (and thus 'admin' needs to be removed from the list, else that user could make themselves admin). Role management plugins used to create custom roles are the ones that would be using that filter. Otherwise this function is essentially get_roles() (which doesn't exist).

Presumably your plugin will only offer the settings page in question to someone who has admin-level capabilities like 'manage_options' and is basically an admin with access to all roles, so the filter shouldn't affect you.

There is also wp_dropdown_roles() which gives you the roles as <option> fields for a <select> list (though checkboxes are likely to work better in many scenarios where you're choosing who has access to something).

Try this:

function get_role_names() {

global $wp_roles;

if ( ! isset( $wp_roles ) )
    $wp_roles = new WP_Roles();

return $wp_roles->get_names();
}

PS heh, missed that explanation and reply, too fast me :)

For those which have multilingual site, function

function wp_roles_array() {
    $editable_roles = get_editable_roles();
    foreach ($editable_roles as $role => $details) {
        $sub['role'] = esc_attr($role);
        $sub['name'] = translate_user_role($details['name']);
        $roles[] = $sub;
    }
    return $roles;
}

returns localized array like this (role names are in Slovak language):

Array
(
    [0] => Array
        (
            [role] => administrator
            [name] => Administrátor
        )

    [1] => Array
        (
            [role] => editor
            [name] => Editor
        )

    [2] => Array
        (
            [role] => author
            [name] => Autor
        )

    [3] => Array
        (
            [role] => contributor
            [name] => Prispievateľ
        )
)

This is how to get an array of all the existing user roles, and the capabilities for each role, in WordPress. If you don’t want to print it to the screen, omit the last line. The $roles variable on line 2 will hold the array of users and capabilities so that you can use it however you need to. See below for an example of the returned array.

global $wp_roles;
$roles = $wp_roles->roles; 

// print it to the screen
echo '<pre>' . print_r( $roles, true ) . '</pre>';

I'm not sure if the accepted answer is the best solution to the question, as according to the documentation, get_editable_roles() retrieves a filtered list of user roles that the current user is allowed to edit.

Maybe we just need to use wp_roles(). It retrieves the global WP_Roles instance and instantiates it if necessary. And if you just want an array with the roles ids as keys and names as values you can do this:

$roles = wp_roles()->get_names();

Here is how you can find the list of roles without any plugins or function http://screencast.com/t/uaWsGLAR3Sh

本文标签： securityGetting a List of Currently Available Roles on a WordPress Site