Adding Role Based User Access Controls to your WordPress Plugin

complete-example.php

<?php
class jinx {

    // stores the path to our plugin
    protected $pluginurl;
    
    // stores the ACL roles
    protected $defaultOptionVals;

    /**
     * The default constructor.
     */
    function __construct()
    {
        $this->pluginurl = WP_PLUGIN_URL . '/jinx/';
    }

    /**
    * The init method.
    */
    public function init()
    {
        // restrict access to admin section and selected user roles
        if (is_admin() && $this->hasPluginAccess()) {
            // add an admin options menu
            add_action('admin_menu', array(&$this, 'admin_menu'));
    
            // register markitup
            add_action('admin_init', array(&$this, 'jinx_admin_init'));
            
            // add javascript to admin
            add_action('admin_head', array(&$this, 'load_headers'), 1000);
            
            // add custom box to admin
            add_action('admin_menu', array(&$this, 'add_custom_box'), 1000);
        
            // watch for post submisions
            add_action('edit_post', array(&$this, 'submit_meta_tag'));
            add_action('publish_post', array(&$this, 'submit_meta_tag'));
            add_action('save_post', array(&$this, 'submit_meta_tag'));
            add_action('edit_page_form', array(&$this, 'submit_meta_tag'));
        }
    
        // add javascript to page and blog posts
        add_filter('the_content', array(&$this, 'add_javascript_to_post'), 9999);
    }

    /**
     * Checks that the logged in user's role is contained within the
     * selected (or default) plugin roles.
     */
    public function hasPluginAccess()
    {
        global $user_ID;
        
        // specify the default roles which have access to the plugin
        $this->defaultOptionVals = array(
            'roles' => array('administrator', 'editor', 'author')
        );
        
        // get all current option values and override defaults
        $options = get_option('jinx_roles');
        if (!empty($options)) {
            $this->defaultOptionVals = array_merge($this->defaultOptionVals, $options, array('administrator'));
        }
        
        // ensure we have a logged in user
        if (!empty($user_ID)) {
            $user = new WP_User($user_ID);
            if (!is_array($user->roles)) $user->roles = array($user->roles);
            foreach ($user->roles as $role) {
                if (in_array($role, $this->defaultOptionVals)) {
                    return true;
                }
            }
        }
        
        return false;
    }
    
    /**
     * Admin menu entry.
     *
     * @access public
     */
    public function admin_menu()
    {
        if (function_exists('add_options_page')) {
            $id = add_options_page('JinX Options', 'JinX Options', 10, basename(__FILE__), array(&$this, 'admin_options'));
        }
    }
    
    /**
     * Options page.
     *
     * @access public
     */
    public function admin_options()
    {
        // grab the array of all user roles
        $roles = new WP_Roles();
        $roles = array_keys($roles->role_names);
    
        // watch for form submission
        if (!empty($_POST['jinx_roles'])) {
            // validate the referer
            check_admin_referer('jinx_options_valid');
    
            if (empty($_POST['jinx_roles'])) {
                echo '<div id="message" class="updated fade"><p><strong>' . __('You must select at least one role for this application to be properly enabled.') . '</strong></p></div>';
                return false;
            }
    
            // update the new value
            $this->defaultOptionVals['roles'] = $_POST['jinx_roles'];
    
            // update options settings
            update_option('jinx_roles', $this->defaultOptionVals);
    
            // show success
            echo '<div id="message" class="updated fade"><p><strong>' . __('Your configuration settings have been saved.') . '</strong></p></div>';
        }
    
        // display the admin options page
    ?>
    
        <div style="width: 620px; padding: 10px">
            <h2><?php _e('Me Likey Options'); ?></h2>
            <form action="" method="post" id="me_likey_form" accept-charset="utf-8" style="position:relative">
                <?php wp_nonce_field('jinx_options_valid'); ?>
                <input type="hidden" name="action" value="update" />
                <table class="form-table">
                    <tr valign="top">
                        <th scope="row">User Role Restriction*</th>
                        <td>
                            <select name="jinx_roles[]" id="jinx_roles" multiple="multiple" size="10">
                            <?php
                            if (!empty($roles)):
                                foreach ($roles as $role):
                                    echo '<option value="' . $role . '"' . (in_array($role, $this->defaultOptionVals['roles']) ? ' selected="selected"' : ”) . '>' . $role . '</option>';
                                endforeach;
                            endif;
                            ?>
                            </select>
                        </td>
                    </tr>
                    <tr valign="top">
                        <th scope="row">&nbsp;</th>
                        <td>Please select all user roles from the multi-select that you wish to allow access to this plugin.</td>
                    </tr>
                    <tr valign="top">
                        <th scope="row">&nbsp;</th>
                        <td>
                            <input type="submit" name="Submit" class="button-primary" value="<?php _e('Save Changes') ?>"/>
                        </td>
                    </tr>
                </table>
            </form>
        </div>
    <?php
    }

}

// load the class
$jinx = new jinx();

// load the initializer method following WordPress initialization
add_action('init', array(&$jinx, 'init'));

pt1-class-scaffolding.php

<?php
class jinx {

    // stores the path to our plugin
    protected $pluginurl;
    
    // stores the ACL roles
    protected $defaultOptionVals;

    /**
     * The default constructor.
     */
    function __construct()
    {
        $this->pluginurl = WP_PLUGIN_URL . '/jinx/';
    }

    /**
     * The init method.
     */
    public function init()
    {
        // restrict access to admin section and selected user roles
        if (is_admin() && $this->hasPluginAccess()) {
            // add an admin options menu
            add_action('admin_menu', array(&$this, 'admin_menu'));
    
            // register markitup
            add_action('admin_init', array(&$this, 'jinx_admin_init'));
            
            // add javascript to admin
            add_action('admin_head', array(&$this, 'load_headers'), 1000);
            
            // add custom box to admin
            add_action('admin_menu', array(&$this, 'add_custom_box'), 1000);
        
            // watch for post submisions
            add_action('edit_post', array(&$this, 'submit_meta_tag'));
            add_action('publish_post', array(&$this, 'submit_meta_tag'));
            add_action('save_post', array(&$this, 'submit_meta_tag'));
            add_action('edit_page_form', array(&$this, 'submit_meta_tag'));
        }
    
        // add javascript to page and blog posts
        add_filter('the_content', array(&$this, 'add_javascript_to_post'), 9999);
    }

}

// load the class
$jinx = new jinx();

// load the initializer method following WordPress initialization
add_action('init', array(&$jinx, 'init'));

pt2-class-restriction-method.php

<?php
/**
 * Checks that the logged in user's role is contained within the
 * selected (or default) plugin roles.
 */
public function hasPluginAccess()
{
    global $user_ID;
    
    // specify the default roles which have access to the plugin
    $this->defaultOptionVals = array(
        'roles' => array('administrator', 'editor', 'author')
    );
    
    // get all current option values and override defaults
    $options = get_option('jinx_roles');
    if (!empty($options)) {
        $this->defaultOptionVals = array_merge($this->defaultOptionVals, $options, array('administrator'));
    }
    
    // ensure we have a logged in user
    if (!empty($user_ID)) {
        $user = new WP_User($user_ID);
        if (!is_array($user->roles)) $user->roles = array($user->roles);
        foreach ($user->roles as $role) {
            if (in_array($role, $this->defaultOptionVals)) {
                return true;
            }
        }
    }
    
    return false;
}

pt3-admin-options-page.php

<?php
/**
 * Admin menu entry.
 *
 * @access public
 */
public function admin_menu()
{
    if (function_exists('add_options_page')) {
        $id = add_options_page('JinX Options', 'JinX Options', 10, basename(__FILE__), array(&$this, 'admin_options'));
    }
}

/**
 * Options page.
 *
 * @access public
 */
public function admin_options()
{
    // grab the array of all user roles
    $roles = new WP_Roles();
    $roles = array_keys($roles->role_names);

    // watch for form submission
    if (!empty($_POST['jinx_roles'])) {
        // validate the referer
        check_admin_referer('jinx_options_valid');

        if (empty($_POST['jinx_roles'])) {
            echo '<div id="message" class="updated fade"><p><strong>' . __('You must select at least one role for this application to be properly enabled.') . '</strong></p></div>';
            return false;
        }

        // update the new value
        $this->defaultOptionVals['roles'] = $_POST['jinx_roles'];

        // update options settings
        update_option('jinx_roles', $this->defaultOptionVals);

        // show success
        echo '<div id="message" class="updated fade"><p><strong>' . __('Your configuration settings have been saved.') . '</strong></p></div>';
    }

    // display the admin options page
?>

    <div style="width: 620px; padding: 10px">
        <h2><?php _e('Me Likey Options'); ?></h2>
        <form action="" method="post" id="me_likey_form" accept-charset="utf-8" style="position:relative">
            <?php wp_nonce_field('jinx_options_valid'); ?>
            <input type="hidden" name="action" value="update" />
            <table class="form-table">
                <tr valign="top">
                    <th scope="row">User Role Restriction*</th>
                    <td>
                        <select name="jinx_roles[]" id="jinx_roles" multiple="multiple" size="10">
                        <?php
                        if (!empty($roles)):
                            foreach ($roles as $role):
                                echo '<option value="' . $role . '"' . (in_array($role, $this->defaultOptionVals['roles']) ? ' selected="selected"' : ”) . '>' . $role . '</option>';
                            endforeach;
                        endif;
                        ?>
                        </select>
                    </td>
                </tr>
                <tr valign="top">
                    <th scope="row">&nbsp;</th>
                    <td>Please select all user roles from the multi-select that you wish to allow access to this plugin.</td>
                </tr>
                <tr valign="top">
                    <th scope="row">&nbsp;</th>
                    <td>
                        <input type="submit" name="Submit" class="button-primary" value="<?php _e('Save Changes') ?>"/>
                    </td>
                </tr>
            </table>
        </form>
    </div>
<?php
}