plugins - How to authorize viewing and clicking a function only logged users?

admin管理员组

文章数量:1278985

I am creating a plugin that allow the users logged to favorite the posts. At first, I create a shortcode for put in the posts.

function add_favorite_shortcode() {
        global $post_id;
        $post_id = get_post();
        $post_id = !empty( $post_id ) ? $post_id->ID : false;
        $output = '<div class="redimensionar"><a id="teste" href="?faction=add&amp;postid='. $post_id .'" title="teste" rel="nofollow">♥ Favorito</a></div>';
        return $output;
     }
     add_shortcode( 'favorito', 'add_favorite_shortcode' );

Now, I would like the enable this function only for users logged, how to do it?

I found this function,

function only_authorised_rest_access( $result )
    {
        if( ! is_user_logged_in() ) {
            return new WP_Error( 'rest_unauthorised', __( 'Only authenticated users can access the REST API.', 'rest_unauthorised' ), array( 'status' => rest_authorization_required_code() ) );
        }

        return $result;
    }
    add_filter( 'rest_authentication_errors', 'only_authorised_rest_access');

but is not working to me

I am creating a plugin that allow the users logged to favorite the posts. At first, I create a shortcode for put in the posts.

function add_favorite_shortcode() {
        global $post_id;
        $post_id = get_post();
        $post_id = !empty( $post_id ) ? $post_id->ID : false;
        $output = '<div class="redimensionar"><a id="teste" href="?faction=add&amp;postid='. $post_id .'" title="teste" rel="nofollow">♥ Favorito</a></div>';
        return $output;
     }
     add_shortcode( 'favorito', 'add_favorite_shortcode' );

Now, I would like the enable this function only for users logged, how to do it?

I found this function,

function only_authorised_rest_access( $result )
    {
        if( ! is_user_logged_in() ) {
            return new WP_Error( 'rest_unauthorised', __( 'Only authenticated users can access the REST API.', 'rest_unauthorised' ), array( 'status' => rest_authorization_required_code() ) );
        }

        return $result;
    }
    add_filter( 'rest_authentication_errors', 'only_authorised_rest_access');

but is not working to me

• plugins
• php

Share Improve this question edited Oct 24, 2021 at 0:43 Rodrigo Franco asked Oct 23, 2021 at 22:08 Rodrigo FrancoRodrigo Franco 522 bronze badges 4

• the action that handles this ( ?faction=add etc ) is missing from your code. Even if you hide it anybody could directly hit that URL, and they could pass any post ID they want to favourite any post they want and ignore your shortcode and shortcode function – Tom J Nowell ♦ Commented Oct 23, 2021 at 22:14
• Yes, that is why I would like to fix it. How to fix it? Have a way to authorize only the users logged? – Rodrigo Franco Commented Oct 23, 2021 at 22:31
• The rest_authentication_errors filter you found and edited into your question is completely unrelated to your problem, however, it contains the answer, which was also posted below by Catherine. – Tom J Nowell ♦ Commented Oct 24, 2021 at 20:25
• Also your endpoints security problem is a separate question, you should not expand your question to add extra things, it's unfair to people who answered the question, and very, very confusing to new people who find it. If you have a new or additional question, ask it separately via the Ask Question button ( and share the code you're using when you do it ) – Tom J Nowell ♦ Commented Oct 24, 2021 at 20:27

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

If you want to hide the output of this shortcode from users who aren't logged in, I'd make use of the is_user_logged_in() function built right into Wordpress.

The issue you'll run into, however, as Tom pointed out in the comments, is that you will need to check if users are logged in as part of the action that runs to favorite the post. Hiding the button doesn't actually prevent users from using the action unless you protect the action itself as well.

本文标签： pluginsHow to authorize viewing and clicking a function only logged users