Wordpress secure way to have Private/Public posts

Question

I've asked a few questions trying to solve this simple problem, but nothing seems to work.

Whats the recommended way to have private/public posts? I want to have a site that if an author/editor/administrator are logged in every private post and public post are viewable/searchable. If the user is not logged in only public posts a viewable.

I have thought about/tried doing this a number of ways. A simple way I achieved this way using a WP_Query to include/excluded all posts with a custom field "Private" when logged in/out.

While this worked fine I have two problems with it, how secure is it? and It requires a custom field, when Wordpress already has private post functionality.

The other way I have tried is to use Wordpress built in Private post feature but I cant get the private post to show up on the front-end. They show up in the edit screen for allowed users and in the loop(front-end) for admins but not editors or authors....

Using wordpress built in functions is my perferrred method but just cant get it to work correctly.

any suggestions or help? Someone must have done this without the need for a custom field?

thanks

score 0 · Answer 1 · answered May 09 '13 at 00:18

0

You dont need to use a meta field to get private posts, its available on the wp query post_status parameter.

$args = array( 'post_status' => array( 'publish' ) ); // regular users
if ( is_user_logged_in() ) {
  // signed in users
  $args['post_status'][] = 'private';
}

$query = new WP_Query( $args);

answered May 09 '13 at 00:18

RafH

4,504
2
23
23

Ok yes this seem to work great too, thanks. Do you know if theres a way I can make this site wide? rather than adding it to every query? if that make sense. cheers for the input – invamped May 09 '13 at 00:30
I dont know if its possible to modify WP Query default values in a clean way, maybe you could ask here http://wordpress.stackexchange.com/ – RafH May 09 '13 at 00:45
Ok thanks again for your help. Hmmm maybe I can add it to function.php? – invamped May 09 '13 at 00:50

score 0 · Answer 2 · answered May 09 '13 at 00:30

I believe the most appropriate in your case is to use WordPress capabilities. Editors are already able to view private posts/pages on the front-end if logged in (because they have the read_private_posts capability).

Here's an example of how you would make private posts/pages viewable by author user role.

function so0805_init_theme_add_capabilities(){
    /* allow authors to view private posts and pages */
    $role_author = get_role('author');
    $role_author->add_cap('read_private_pages');
    $role_author->add_cap('read_private_posts');

}
add_action('init', 'so0805_init_theme_add_capabilities');

Paste this code inside functions.php of your theme.

This shows private post written by the current author and allows authors to view the private posts in the edit screen and via single.php but does not show up on the front-page loop. I'm I missing something? thanks — invamped, May 09 '13 at 00:42

Wordpress secure way to have Private/Public posts

2 Answers2