WP_User::has_cap( string $cap, mixed $args ): bool

Description

$user->has_cap( 'edit_posts' );
$user->has_cap( 'edit_post', $post->ID );
$user->has_cap( 'edit_post_meta', $post->ID, $meta_key );

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$capstring

Capability name.

$argsmixed

Optional further parameters, typically starting with an object ID.

Return value

bool

Whether the user has the given capability, or, if an object ID is passed, whether the user has the given capability for that object.

Performance profile

How much work a call to WP_User::has_cap() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via get_post().

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

26–63

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 70.

Plugin surface

1 hook

Third-party callbacks on 'user_has_cap' run inside this call, and their cost is not bounded by anything here.

Called by

0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

• hookthird-party callbacksapply_filters()called directly
• querycontent queryget_post()one call below WP_User::has_cap()
• optionoption read or writeget_option()one call below WP_User::has_cap()

Further down the call graph this can also reach cache, serialize and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 6 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost WP_User::has_cap() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 1

One hook fires while WP_User::has_cap() runs, in this order:

1. 1
   apply_filters( user_has_cap )filterline 813 (+37 into the body)

   Dynamically filter a user's capabilities.

Uses · 7

• _deprecated_argument()Marks a function argument as deprecated and inform when it has been used.
• __()Retrieves the translation of $text.
• map_meta_cap()Maps a capability to the primitive capabilities required of the given user to satisfy the capability being checked.
• is_multisite()Determines whether Multisite is enabled.
• is_super_admin()Determines whether user is a site admin.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• WP_User::translate_level_to_cap()Converts numeric level to level capability name.

Source code

View on Trac ↗View on GitHub ↗

776	public function has_cap( $cap, ...$args ) {777		if ( is_numeric( $cap ) ) {778			_deprecated_argument( __FUNCTION__, '2.0.0', __( 'Usage of user levels is deprecated. Use capabilities instead.' ) );779			$cap = $this->translate_level_to_cap( $cap );780		}781 782		$caps = map_meta_cap( $cap, $this->ID, ...$args );783 784		// Multisite super admin has all caps by definition, Unless specifically denied.785		if ( is_multisite() && is_super_admin( $this->ID ) ) {786			if ( in_array( 'do_not_allow', $caps, true ) ) {787				return false;788			}789			return true;790		}791 792		// Maintain BC for the argument passed to the "user_has_cap" filter.793		$args = array_merge( array( $cap, $this->ID ), $args );794 795		/**796		 * Dynamically filter a user's capabilities.797		 *798		 * @since 2.0.0799		 * @since 3.7.0 Added the `$user` parameter.800		 *801		 * @param bool[]   $allcaps Array of key/value pairs where keys represent a capability name802		 *                          and boolean values represent whether the user has that capability.803		 * @param string[] $caps    Required primitive capabilities for the requested capability.804		 * @param array    $args {805		 *     Arguments that accompany the requested capability check.806		 *807		 *     @type string    $0 Requested capability.808		 *     @type int       $1 Concerned user ID.809		 *     @type mixed  ...$2 Optional second and further parameters, typically object ID.810		 * }811		 * @param WP_User  $user    The user object.812		 */813		$capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args, $this );814 815		// Everyone is allowed to exist.816		$capabilities['exist'] = true;817 818		// Nobody is allowed to do things they are not allowed to do.819		unset( $capabilities['do_not_allow'] );820 821		// Must have ALL requested caps.822		foreach ( (array) $caps as $cap ) {823			if ( empty( $capabilities[ $cap ] ) ) {824				return false;825			}826		}827 828		return true;829	}

Changelog

Introduced in 2.0.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/class-wp-user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.