=== Access Areas for WordPress === Contributors: podpirate Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=WF4Z3HU93XYJA Tags: access, role, capability, user, security, editor Requires at least: 4.6 Requires PHP: 5.6 Tested up to: 6.9 Stable tag: 1.5.22 License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Fine tuning access to your posts. == Description == WP Access Areas lets you fine-tune who may read, edit or comment on your Blog posts. You can either restrict access to logged-in uses only, certain WordPress-Roles or even custom Access Areas. = Features = - Define custom Access Areas and assign them to your blog-users - Restrict reading, editing and commenting permission to logged-in users, certain WordPress-Roles or Access Areas - define global access areas on a network - Supports bulk editing - German, Italian, Polish and Swedish localization (Huge Thankyou @ all translators!) = Known Issues = - WordPress calendar Widget still shows dates where restricted posts have been created. When clicked on such a date a 404 will occur. There is an open [WordPress Core ticket on that issue](https://core.trac.wordpress.org/ticket/29319). - Taxonomy menus (e.g. Tags / Categories) also count restricted posts when the total number of posts in a taxonomy is ascertained. See [this post](http://wordpress.org/support/topic/archive-recents-posts-last-comments-show-restricted-content?replies=5#post-5929330) for details. = Development = Please head over to the source code [on Github](https://github.com/mcguffin/wp-access-areas). == Installation == 1. Upload the 'wp-access-areas.zip' to the `/wp-content/plugins/` directory and unzip it. 2. Activate the plugin through the 'Plugins' menu in WordPress == Frequently asked questions == = Why can't I protect media? = Because the plugin can only protect posts, which are database entries. A media also contains a file stored on your servers file system. A file is normally just returned by the server, the WordPress core is not involved. In order to protect a file, let's say an image, the Image URL would have to be point to a special Script, that decides whether the file is protected or not, and if so, which user or group of users would be granted access. A lot of processing would be going on, and each and every little thumbnail would add another one or two seconds to your page load time. The result: Tears, rage and support requests. = What does it exactly do? = For each Post it stores a capabilty the user needs to have in order to view, edit or comment on a post. By defining an Access Area you create nothing more than a custom capability. = Why didn't you use post_meta to store permissions? WordPress already provides an API for this! = I did this mainly for performance reason. For detecting the reading-permission on specific content, the plugin mainly affects the WHERE clause used to retrieve posts. In most cases, using post_meta would mean to add lots of JOIN clauses to the database query, slowing down your site's performance. = Does it mess up my database? = It makes changes to your database, but it won't make a mess out of it. Upon install it does two things: 1. It creates a table named ´{$wp_prefix}_disclosure_userlabels´. The access areas you define are here. 2. It adds three columns to Your Posts tables: post_view_cap and post_comment_cap. Upon uninstall these changes will be removed completely, as well as it will remove any custom generated capability from your user's profiles. = I'd like to do some more magic / science with it. And yes: I can code! = Developer documentation can be found in [the project wiki](https://github.com/mcguffin/wp-access-areas/wiki). = I found a bug. Where should I post it? = Please do so in the [GitHub Repository](https://github.com/mcguffin/wp-access-areas). = I found a bug and fixed it. How can I contribute? = Pull request are welcome in the [GitHub Repository](https://github.com/mcguffin/wp-access-areas). == Screenshots == 1. Area Access Manager 2. User Editing 3. Post Access Control 4. Post Access Behaviour == Changelog == = 1.5.22 = - Fix: _load_textdomain_just_in_time warning = 1.5.21 = - Rename Plugin from "WordPress Access Areas" to "Access Areas for WordPress". = 1.5.20 = - Security Fix: Authenticated XSS in Acceas Areas List Table (discovered by [0xd4rk5id3](https://patchstack.com/database/researcher/4e4561e4-5f79-419b-9832-33d7fd94c5a4)) = 1.5.19 = - Fix: Nonce Verification fails when using WP password reset = 1.5.18 = - Fix: PHP Warning when using plugin together with imsanity = 1.5.17 = - Fix: Access settings broken in post quick edit = 1.5.15 = - Fix: could not save website settings in network admin when running on multisite - Fix: role capabilities not saved = 1.5.14 = - Fix: could not add caps on user-edit = 1.5.13 = - Fix: WP deprecation warning - Fix: Chrome DOM warning = 1.5.12 = - Fix: nonce error when adding User in network admin if plugin is not network active = 1.5.11 = - Fix: __doint_it_wrong message wpdb->prepare = 1.5.10 = - Fix: wpdb table prefix messed up in multisite = 1.5.9 = - Fix: Pages saved via ajax not working. (Elementor) = 1.5.8 = - Security hardening = 1.5.7 = - Fix anaother PHP Warning = 1.5.6 = - Fix Multisite Database Error when WPAA is not active for network. = 1.5.5 = - Fix PHP Warning = 1.5.4 = - Fix WSOD when saving post = 1.5.3 = - Fix a Bug where a logged in user wasn't redirected to the fallback page. Thanks to [Andrey Shevtsov](https://github.com/freeworlder) - Merry Christmas (Gregorian Calendar) = 1.5.2 = - Fix Multisite: Network Access Areas were visible when plugin was single activated - Introduce filters: `wpaa_can_protect_{$post_type}`, `wpaa_can_edit_{$post_type}_view_cap`, `wpaa_can_edit_{$post_type}_edit_cap`, `wpaa_can_edit_{$post_type}_comment_cap` = 1.5.1 = - Localization: move de_DE and de_DE_formal to translate.wordpress.org = 1.5.0 = - Fix: A network admin without blog role could not edit post access by WP Roles - Plugin settings: Use WP Post statuses in favor of hard coded status list (allows use of custom post statuses now) - Introduce filter: 'wpaa_allowed_post_stati' - Localization: Rework strings - Localization: Introduce de_DE_formal - Localization: consistent use of plugin textdomain = 1.4.7 = - Fix: PHP deprecated warning during install + network upgrade - Fix: Incorrect Post Classes = 1.4.6 = - Fix: Crash during install = 1.4.5 = - Fix: WP _doing_it_wrong message = 1.4.4 = - Fix: Multisite install procedere - Fix: Add self repair functionality (Ass missing posts table columns) = 1.4.3 = - Fix: Post Custom behavior not dispalying in metabox when fallback page is default fb page - Fix: invalid login redirect URI in subdirectory installs = 1.4.2 = - Fix: no restrictions for empty post objects (fixes buddypress profile page issue) - Fix: wrong redirection behavior for logged in users = 1.4.1 = - Fix: set suppress_filters to false on get_posts - Fix: Saving Access Area Name = 1.4.0 = - Feature: Explicitly enable / disable custom behaviour on posts. - UI: Combine columns in Posts list table - Fix: Contained roles were not assumed correctly - Fix: QuickEdit did not show Access after save - Compatibility: Drop support for WP < 3.8 - Code refactoring, switched classname prefixes = 1.3.3 = - Fix: Database error on comment feeds. Hiding or redirecting from comment feeds should work now. - Fix: Crash during update (function `get_editable_roles` not found) = 1.3.2 = - Security Fix: Exclude restricted posts from comment feeds = 1.3.1 = - Fix: Possible vulnerability where unauthorized users could change post access settings - L10n: change plugin textdomain from 'wpundisclosed' to 'wp-access-areas' (= Plugin slug). Rename lang/ > languages/. = 1.3.0 = - WordPress 4.0 compatibility - Feature: Show Access Columns on Media and Custom Post type list views - Feature: Select default access for new posts. - Feature: Role Caps. Set which roles can edit post access properties - Improvement: Cache DB results - Plugin API: Added filter: wpaa_update_access_area_data - Plugin API: Added actions: wpaa_grant_access, wpaa_grant_{$wpaa_capability}, wpaa_revoke_access, wpaa_revoke_{$wpaa_capability}, wpaa_create_access_area, wpaa_update_access_area - Plugin API: Added function: wpaa_get_access_area( $identifier ) = 1.2.9 = Fixing that one: http://wordpress.org/support/topic/plugin-causing-crash-post-woocommerce-update-today?replies=5 = 1.2.8 = - Fix: Post Edit save 404 behaviour - Fix: Hide inacessible posts in Recent Comments widget - Fix: Hide inacessible posts in Latest posts widget - Fix: Hide inacessible posts in Archive widget - Fix: Don't show comments to inaccessible posts in WP-Admin. (Prohibits editing as well.) - L10n: Polish localisation = 1.2.7 = - Feature: Explicitly select Front page as Fallback page. - Feature: Edit view cap now available for backend-only posts as well. - Fix: 404 behaviour not saving when default behaviour is other than 404 - API: added function `wpaa_is_post_public( $post )` = 1.2.6 = - Feature: Option to select post status after deleting access area - Fix: Wrong viewing permissions after delete access area - Fix: remove options upon uninstall - Swedish localization = 1.2.5 = - Feature: Bulk edit users: Grant and revoke access. - Fix: Was able to create access areas with empty names. - Fix: Ignores WP's Comments closed status = 1.2.4 = - Fix: User list table column = 1.2.3 = - Check WP 3.9 compatibility - Fix: With no AAs present add Access Area didn't show up on profile edit page = 1.2.2 = - Fix: Used wrong option name on edit post - Fix: Embarrassing wrong var name on edit post - L10n: Added one more italian string = 1.2.1 = - Feature: Option to redirect to wp-login or to fallback page. - Feature: action hook an filter on access attempt for a restricted post. (see GitHub Repo for details) - Feature: post classes - CSS: use dashicons - Italian localization = 1.2.0 = - Feature: Bulk edit Posts - Feature: Ajax-Add AAs on User edit screen - Debug: Fix invalid HMTL on user list table - Debug: Remove edit post link from frontend - Debug: Invisible posts are now also excluded from editing - Debug: Remove "Who can read"-Select from non-public post types = 1.1.11 = - Debug: Fix Comment issue. Selecting "WordPress default" now does what it is supposed to: handling over the comment responsibility to WordPress. = 1.1.10 = - Debug: Fix missing file issue = 1.1.9 = - Feature/Debug: Network admins now have access to all areas on all blogs. Blog admins have access to all areas on their own blog(s). - Code: put general use processes into function = 1.1.9 = - Feature/Debug: Network admins now have access to all areas on all blogs. Blog admins have access to all areas on their own blog(s). - Code: put general use processes into function = 1.1.8 = - Fixed: Fixed issue, where access areas where not shown on user editing in single-site installs. = 1.1.7 = - Fixed: Fixed issue, where posts table was not modified after creating new blog. Use WP's upgrade network function to fix all posts tables. = 1.1.6 = - Feature: WP-Capability column in Access Areas table view - Fixed: Commenting was still possible after switching off comments and setting comment capabilities to 'use WP defaults'. = 1.1.5 = - Fix [uninstall issue](http://wordpress.org/support/topic/cant-delete-the-plugin) = 1.1.4 = - Fix: issue where WP-comment settings were not applied while saving post - Improve DE Localization = 1.1.3 = - Fix: post tables did not update on wpmu_new_blog - Fix: [deletion issue](http://wordpress.org/support/topic/bug-report-cant-delete-area?replies=1) - Localize Plugin description = 1.1.2 = - Added versioncheck = 1.1.1 = - Improve loading behaviour = 1.1.0 = - Added editing restrictions. - Several fixes. = 1.0.0 = - Initial Release == Upgrade notice == 1.5.20 fixed an authenticated XSS Vulnerability in the Acceas Areas List Table. Everybody should upgrade the plugin ASAP.