Back to my Page

WordPress User, Roles and Capabilities (Status Quo)

As of 2.8.1 Beta. WordPress has a User Modell containting, User, Roles and Capabilities. It has been implemented as classes (since around WP 2.0). Next to the classes there are functions in the global namespace and global variables.

This page is to document the current implementation with as much strict data as possible. Official documentation is Roles and Capabilities.

Terms

Capabilities

Capabilities is the overall term for WordPress capabilities. Capabilities is the data the the decision of what a user is allowed to do is based on. Compare to Permissions in RBAC.

All Capabilities

All capabilities the user has, including individual and role based.

Individual Capabilities

Capabilities of a concrete User (becomes obsolete).

Role Based Capabilities

Capabilities of a concrete Role.

Meta Capabilities

Currently it is unknown to me what the concept is, but some information was available: Meta Capabilities are a certain type of capability. Meta Capability can be of:

• 'delete_user'
• 'edit_user'
• 'delete_post'
• 'delete_page'
• 'edit_post'
• 'edit_page'
• 'read_post'
• 'read_page'

As written in IRC meta capabilites are dynamic capabilities in the terms of checking if a user can edit a post with a specific id. Infact - as confirmed in IRC - this is a static capability in the name of 'edit_own_posts'.

Primitive Capabilities

Currently it is unknown to me what the concept is.

Report

1. Definition / Access of current WP_User modell is not correctly defined and/or documented and/or used.
   • Example: setup_userdata()-function
     • Access private WP_User::$data used publicly
     • Undefined WP_User::$user_login used
     • Undefined WP_User::$user_level used
     • Undefined WP_User::$user_email used
     • Undefined WP_User::$user_url used
     • Undefined WP_User::$user_pass used
     • Undefined WP_User::$display_name used
   • Listing: Different Capability Types
     • capabilities (overall term)
     • meta capabilities (see map_meta_cap())
     • primitive capabilities (see map_meta_cap())

Related Ticket(s)

• #10201