wppaste
WordPress

map_meta_cap( string $cap, int $user_id, mixed $args ): string[]

Since
2.0.0, 4.9.6, 5.1.0, 5.2.0, 5.3.0, 5.7.0, 6.7.0
Source
wp-includes/capabilities.php:45
Maps a capability to the primitive capabilities required of the given user to satisfy the capability being checked.

Description

This function also accepts an ID of an object to map against if the capability is a meta capability. Meta capabilities such as edit_post and edit_user are capabilities used by this function to map to primitive capabilities that a user or role requires, such as edit_posts and edit_others_posts. Example usage: map_meta_cap( 'edit_posts', $user->ID ); map_meta_cap( 'edit_post', $user->ID, $post->ID ); map_meta_cap( 'edit_post_meta', $user->ID, $post->ID, $meta_key ); This function does not check whether the user has the required capabilities, it just returns what the required capabilities are.

Parameters

$capstring
Capability being checked.
$user_idint
User ID.
$argsmixed
Optional further parameters, typically starting with an object ID.

Return

string[]
Primitive capabilities required of the user.

Hooks fired · 4

4 hooks fire while map_meta_cap() runs, in this order:

  1. apply_filters( auth_{$object_type}_meta_{$meta_key}_for_{$object_subtype} )filterline 491 (+446 into the body)

    Filters whether the user is allowed to edit a specific meta key of a specific object type and subtype.

  2. apply_filters( auth_{$object_type}_meta_{$meta_key} )filterline 512 (+467 into the body)

    Filters whether the user is allowed to edit a specific meta key of a specific object type.

  3. do_action( auth_{$object_type}_{$object_subtype}_meta_{$meta_key} )filter_deprecatedline 538 (+493 into the body)

    Filters whether the user is allowed to edit meta for specific object types/subtypes.

  4. apply_filters( map_meta_cap )filterline 876 (+831 into the body)

    Filters the primitive capabilities required of the given user to satisfy the capability being checked.

Uses · 24

Show all 24

Used by · 3

Source

function map_meta_cap( $cap, $user_id, ...$args ) {	$caps = array(); 	switch ( $cap ) {		case 'remove_user':			// In multisite the user must be a super admin to remove themselves.			if ( isset( $args[0] ) && $user_id === (int) $args[0] && ! is_super_admin( $user_id ) ) {				$caps[] = 'do_not_allow';			} else {				$caps[] = 'remove_users';			}			break;		case 'promote_user':		case 'add_users':			$caps[] = 'promote_users';			break;		case 'edit_user':		case 'edit_users':			// Allow user to edit themselves.			if ( 'edit_user' === $cap && isset( $args[0] ) && $user_id === (int) $args[0] ) {				break;			} 			// In multisite the user must have manage_network_users caps. If editing a super admin, the user must be a super admin.			if ( is_multisite() && ( ( ! is_super_admin( $user_id ) && 'edit_user' === $cap && is_super_admin( $args[0] ) ) || ! user_can( $user_id, 'manage_network_users' ) ) ) {				$caps[] = 'do_not_allow';			} else {				$caps[] = 'edit_users'; // edit_user maps to edit_users.			}			break;		case 'delete_post':		case 'delete_page':			if ( ! isset( $args[0] ) ) {				if ( 'delete_post' === $cap ) {					/* translators: %s: Capability name. */					$message = __( 'When checking for the %s capability, you must always check it against a specific post.' );				} else {					/* translators: %s: Capability name. */					$message = __( 'When checking for the %s capability, you must always check it against a specific page.' );				} 				_doing_it_wrong(					__FUNCTION__,					sprintf( $message, '<code>' . $cap . '</code>' ),					'6.1.0'				); 				$caps[] = 'do_not_allow';				break;			} 			$post = get_post( $args[0] );			if ( ! $post ) {				$caps[] = 'do_not_allow';				break;			} 			if ( 'revision' === $post->post_type ) {				$caps[] = 'do_not_allow';				break;			} 			if ( (int) get_option( 'page_for_posts' ) === $post->ID				|| (int) get_option( 'page_on_front' ) === $post->ID			) {				$caps[] = 'manage_options';				break;			} 			$post_type = get_post_type_object( $post->post_type );			if ( ! $post_type ) {				/* translators: 1: Post type, 2: Capability name. */				$message = __( 'The post type %1$s is not registered, so it may not be reliable to check the capability %2$s against a post of that type.' ); 				_doing_it_wrong(					__FUNCTION__,					sprintf(						$message,						'<code>' . $post->post_type . '</code>',						'<code>' . $cap . '</code>'

History

Introduced in 2.0.0. Unchanged from 6.7.7 through 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

6.7.0
Added the edit_block_binding capability.from the docblock
5.7.0
Added the create_app_password, list_app_passwords, read_app_password, edit_app_password, delete_app_passwords, delete_app_password, and update_https capabilities.from the docblock
5.3.0
Formalized the existing and already documented ...$args parameter by adding it to the function signature.from the docblock
5.2.0
Added the resume_plugin and resume_theme capabilities.from the docblock
5.1.0
Added the update_php capability.from the docblock
4.9.6
Added the export_others_personal_data, erase_others_personal_data, and manage_privacy_options capabilities.from the docblock
2.0.0
Introduced.from the docblock

About this page

Parsed data
Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/capabilities.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.