Skip Navigation

[Resolved] Access Rights defined are not taken into account for Frontend Toolset Forms

This support ticket is created 5 years, 4 months ago. There's a good chance that you are reading advice that it now obsolete.

This is the technical support forum for Toolset - a suite of plugins for developing WordPress sites without writing PHP.

Everyone can read this forum, but only Toolset clients can post in it. Toolset support works 6 days per week, 19 hours per day.

Sun Mon Tue Wed Thu Fri Sat
8:00 – 12:00 8:00 – 12:00 8:00 – 12:00 8:00 – 12:00 8:00 – 12:00 - -
13:00 – 17:00 13:00 – 17:00 13:00 – 17:00 13:00 – 17:00 13:00 – 17:00 - -

Supporter timezone: America/New_York (GMT-04:00)

Author
Posts
#1331815

I am trying to: let logged in users edit and delete their own child posts. This only works if i allow the User role to "edit" or "delete" the custom type of "others.

#1331825
2019-09-04_20-22-13.png

See Screenshot for further Details. Only the Seeting DELETE or EDIT "OTHERS" helps to see the buttons in the Forms FRontend.

#1331851

Hi, this is unusual. Can you try these troubleshooting steps first?
- Temporarily deactivate all plugins except Types, Views, Access, and Forms. Activate a default theme like Twenty Nineteen.
- Test again. If the problem is resolved, reactivate your theme and other plugins one by one until the problem returns.
- If the problem is not resolved, please copy + paste in your next reply the shortcodes used to display the Edit Post link and the Delete Post link
- Also please let me know if the child post type is part of any other post relationship besides this parent / child relationship

#1331879

Did the test and the problem is still there.
The shortcode looks like this

 <td width="100%" style="text-align: right;">[cred_link_form form="Preiseintrag" text="bearbeiten" target="_self"] -
          [cred-delete-post-link class="cred-refresh-after-delete" text="entfernen" action="delete"]</tr>
    

The relationship is just with the one parent Object

#1331881

There should probably be a closing td tag before the closing tr tag, but I don't think that's the problem here. May I have logins for an admin and an author so I can test this? Please let me know where I can see the problem on the front-end of the site as an author.

#1332685

It looks like there are some older Forms shortcodes in your code, and the syntax isn't working as expected. As a test, I created this unassigned Content Template:
hidden link
I added the Preisentrag Edit Post Form to that template. Then in this View:
hidden link
I inserted an Edit Post link and a Delete Post link in the loop (not in your custom shortcode). When logged in as author, you can see that edit post link and delete post link here:
hidden link

So I think the CRED shortcodes you have placed in your functions.php file should be replaced with updated shortcodes. Please try that and let me know if it's not working as expected.

#1332983

Hi,
yes you are right there is some PHP Code inside the functions which takes care of the rendering of the output.

Just as a reference this is the part of the code which would do the EDIT or DELETE Links

 
'<td>'.do_shortcode('[cred_link_form form="Preiseintrag" text="bearbeiten" target="_self" post="'.$preise[$preise_keys[$i]]->ID.'"]').' '.do_shortcode('[cred-delete-post-link class="cred-refresh-after-delete" text="entfernen" action="trash"  post="'.$preise[$preise_keys[$i]]->ID.'"]').'</td>'   
	       

i have modified it with the new shortcodes:

'<td>'.do_shortcode('[toolset-edit-post-link content_template_slug=\'preiseintrag\' target="_self"]bearbeiten[/toolset-edit-post-link]').' '.do_shortcode('[cred-delete-post-link class="cred-refresh-after-delete" text="entfernen" action="trash"  post="'.$preise[$preise_keys[$i]]->ID.'"]').'</td>'
 

However i do believe that the Access rights are not taken into account in the right way once the links are inserted via PHP. THis is not a question of right or wrong as you can see with the delete link. which get's displayed correctly if the "is allowed to delete other PReiseintrag" is enabled.

#1334511
screenshot1.png
screenshot2.png
screenshot3.png
screenshot4.png

THis is not a question of right or wrong as you can see with the delete link. which get's displayed correctly if the "is allowed to delete other PReiseintrag" is enabled.
Sorry, I don't understand what you mean. I just tested and it seemed to work correctly for me, so I must be missing something. I logged in as Tester (Author) and I was able to see the "entfernen" link in the table here, see screenshot1.png:
hidden link;

In Access Control, the "Löschen Sie Beiträge anderer mit Toolset Forms" setting is disabled, see screenshot2.png. The delete post link appears as expected for the Author, without needing permission to delete others posts as you described. Then I clicked "entfernen", and confirmed in the popup. See screenshot3.png. The page refreshed, and the post was deleted successfully, see screenshot4.png.

Again, this test is without the permission to delete others posts in Access Control. So I'm not really sure I understand the problem, can you help?