[Resolved] Users that have no rights can connect posts

[Author]

Posts

[henryH]

It would be great if you can give suggestion.
In my application there are two custom post "Obituaries" and "Services" and two type of users "Admin" and "Family".
I have created a Relationship between Obituaries and Services(One to Many).
Right now Family can add "obituaries" and "Services" but I want to apply restriction, Family can add only "Obituaries" Detail and Admin can add "Services" only.
Can I apply this type of functionality?

[Beda]

To control who can do what on WordPress you can use Toolset Access.

You would head to Toolset > Access after installing the plugin and find the post type you want to control
There, you would set the user roles to have certain capabilities or not.
Then, that would apply to those roles.
https://toolset.com/documentation/user-guides/#access

This will make it impossible for Role A to add or do anything else you do not intend to with the certain post type.

The problem is, when you allow to add or edit one post type in a relationship, you can very well deny access to the other, and that will take effect in the WordPress Admin, but NOT in the Post Relationship meta box when you add or edit an actual "parent" post for example.

Let me explain

1. User Role A can add/edit parent type (only)
2. User Role B can add/edit child type (only)

This correctly removes all tools to edit/create any post they are not supposed to in the WordPress Admin.

But if they add or edit a post they are allowed to, then they can actually add and edit as well the posts (related) that they are not supposed to manipulate.

This is obviously wrong, I reported it and we will work on this.

So for now, this is possible but with a risk:
The user can still add/edit related posts in the Metabox made for it.

[henryH]

yes

[Beda]

This will be fixed with the next release 3.1.