Reply To: Frontend bbPress Media Upload fails if ACF is active

• John Huebner

• November 26, 2021 at 2:03 pm

I do not know if this will help you or not. When I was building my options page admin plugin I ran into a similar situation. My plugin creates a post type to store settings for each ACF options page created. One of the settings is the post ID to use to store the options values to just like you can do when creating an options page through code. One of the settings is to save the values to the post created by the plugin. So, for example if you create an options page and the settings create a post id of “1234” then all the values from the options page will be saved against post “1234”.

Everything for this worked fine except for attachments. This happened when an “editor” or “author” tried to update an options page that they were allowed to edit. This is due to the plugin (by default) requiring that the user has the “manage_options” capability in order to create/edit options pages.

What I had to do was temporarily alter the users capabilities to allow the uploads. I did this by adding a filter on the “user_has+cap” hook.

add_filter('user_has_cap', 'your_function_name', 10, 4);

Here is the function with as much explanation as I can give

function your_function_name($allcaps, $caps, $args, $user) {
  if (!defined('DOING_AJAX') || !DOING_AJAX || // files are uploaded using ajax
      !isset($_REQUEST['post_id']) || // the ajax request includes the "post_id"
      !in_array('edit_post', $args) // the user is edtitng a post
  ) {
    // this happens if
    //    1) the request is not an ajax request
    //    2) the post ID is not included in the AJAX request
    //    3) the user is doing anything other than editing a post
    return $allcaps;
  }
  $id = intval($_REQUEST['post_id']);
  if (get_post_type($id) != $this->post_type ||  // post being edited matches the post typr of the post
      !isset($this->options_pages[$id]) // the post ID is a post in this post type
  ) {
    // in my case this is part of a class with the post type name defined in the class
    // $this->options_pages is an array of all of the currently active options page settings
    // this happens if the post type being edited is not an active options page
    return $allcaps;
  }
  // remove this filter to prevent infinite loop
  remove_filter('user_has_cap', 'your_function_name', 10);
  
  // get the options page setting from the option pages array
  $page = $this->options_pages[$id];
  // get the capability needed to edit values on this options page
  $cap = $page['acf']['capability'];
  // check to see if the current user has the capability required to edit
  // the options page being edited
  if (current_user_can($cap)) {
    // this user is allowed to edit the options page
    // add all $caps to $allcaps
    // what this does is temporarily grant the user with all capabilities
    // as if they have the "manage_options" capability
    foreach ($caps as $add) {
      $allcaps[$add] = true;
    }
  }
  // readd this filter
  add_filter('user_has_cap', 'your_function_name', 10, 4);
  return $allcaps;
}