Skip Navigation

[Resolved] Toolset Access on custom post

This thread is resolved. Here is a description of the problem and solution.

Problem: I would like to restrict access to posts using Toolset Access and a custom field on each post that stores a numeric User ID. The User whose ID is stored in the custom field should have access to the post, but no one else should. This doesn't seem to be working as expected.

Solution: The "own" or ownership referred to in Access can only be defined as the post author, not a custom field value or any other association type. In other words, the post's author is the only owner of a post, as far as Access is concerned. If you'd like to use this Access feature to limit or allow editing of "own" posts, you must set each User as the author of their own post(s).

To restrict access to editing posts with Forms, you must use the Toolset Forms tab in Toolset > Access Control to modify the access settings per Form.

Relevant Documentation:
https://toolset.com/documentation/user-guides/access-control/
https://toolset.com/documentation/user-guides/access-control/access-control-for-cred-forms/
https://toolset.com/documentation/post-relationships/how-to-create-custom-searches-and-relationships-for-users/

This support ticket is created 4 years, 8 months ago. There's a good chance that you are reading advice that it now obsolete.

This is the technical support forum for Toolset - a suite of plugins for developing WordPress sites without writing PHP.

Everyone can read this forum, but only Toolset clients can post in it. Toolset support works 6 days per week, 19 hours per day.

Sun Mon Tue Wed Thu Fri Sat
8:00 – 12:00 8:00 – 12:00 8:00 – 12:00 8:00 – 12:00 8:00 – 12:00 - -
13:00 – 17:00 13:00 – 17:00 13:00 – 17:00 13:00 – 17:00 13:00 – 17:00 - -

Supporter timezone: America/New_York (GMT-04:00)

Author
Posts
#1613741
Screen Shot 2020-05-06 at 5.56.01 AM.png

Tell us what you are trying to do?

I have code that allows import of posts of a custom post type and also associates those posts to users in the database. I am using the 'wpcf-user-id' value to make that association. In the front end there is a a Toolset Post form to allow those associated users to edit the post content, of the posts they own. On the frontend the form is not showing for the logged in user. Toolset Access is restricting the form from being displayed, despite that the permissions are set correctly to allow the user type to edit that custom post. I have trimmed down as much of the staged site I can as far as plugins without crippling the site. I would like to get some advice before I have to strip it down some more, if you have any on anything else I can look at.

Is there any documentation that you are following?

Just the basic function of the Toolset Form and setting permissions for the user type in Toolset Access. Again, this is working correctly locally.

Is there a similar example that we can see?

What is the link to your site?

Here is the dev / staging site:
hidden link

You can login as a user here:
hidden link

You can view the custom post types here:
hidden link

Here are where the posts associated to the user live:
hidden link

If you try to edit the first animal in the list, you will see that Toolset Access is blocking the form:
hidden link

The user is of a 'Customer' role and should have the ability to edit their own post. (Animals, attached)
hidden link

These posts are being created programmatically. Is there some other field besides 'wpcf-user-id' being set to a user id, to allow Toolset Access to allow access to the form?

Let me know what you think or if you have any other questions.
Thanks for your time.

#1614547

I am using the 'wpcf-user-id' value to make that association.
Hello, the "own" or ownership referred to in Access can only be defined as the post author, not a custom field value or any other association type. In other words, the post's author is the only owner of a post, as far as Access is concerned. If you'd like to use this Access feature to limit or allow editing of "own" posts, you must set each User as the author of their own post(s).

Toolset Access is restricting the form from being displayed, despite that the permissions are set correctly to allow the user type to edit that custom post.
Okay I see your screenshot is displaying the settings for editing posts in a specific post type - "Animals". Please note that there is another setting required to manage editing with Toolset Forms. The settings shown in your screenshot are specific to editing on the backend, i.e. in wp-admin. For editing on the frontend with Forms, you should also manage your Form permissions in Toolset > Access Control > Toolset Forms tab. There you can manage permissions for each individual Form per User Role.

For your security I have removed the login credentials you included. I have those in a private note in case I need them, but they are not publicly visible anywhere. URLs you post in the forum are automatically obscured from other Users so no worries on those, but in the future it's best to use private reply fields for logins and passwords. If you need to share multiple logins, you can ask the supporter to open up more private reply fields for you.

Also if you're interested in how to create something like Toolset's post relationships between Users and posts, or if you're interested in creating custom parametric search forms for Users, I encourage you to check out this article about using a proxy post to represent Users: https://toolset.com/documentation/post-relationships/how-to-create-custom-searches-and-relationships-for-users/
Even though your posts are created programmatically instead of using Forms, you might find this useful.

Please let me know if you have additional questions about these concepts.

#1616943

Thanks Christian. It was a dumb mistake on my side and this is working now, after you pointed me in the right direction. Thank you for your help!