Restrict "Author" user to see only images he sends

Question

I need your help to make the "Author" user have restrictions only to view the media he sends.

Normally the author has access to all images sent by all users and I need to restrict this access to only the images that he sends himself, so that he creates his own window and manages only it.

Just for the record I’m using the Storefront theme that is a Woocommerce and I want registered customers (who are by default to be registered as authors) to manage only their own product showcases.

Thanks in advance.

Answer 1

Assuming that the user will have at all times the role "Author", you can restrict the media library using the action called pre_get_posts.

For teaching purposes, actions - in a very simple way - they are things that occur in the land of WP. You can make the hook (hook, in English) of some methods in these actions, to ensure that such a method occurs at the time of such action. We are interested in pre_get_posts because WP, to fill the library page with the images, makes a query searching for posts that have images. The cat jump is on, before this query is made (hence the prefix "pre"), we include a change in the parameters of this query, restricting by author. In terms of code, this translates into

add_action('pre_get_posts', 'restringir_biblioteca' );
function restringir_biblioteca($wp_query_obj){
    global $current_user, $pagenow;
    if(!is_a($current_user, 'WP_User')){
        return;
    }
    if ('admin-ajax.php' != $pagenow or $_REQUEST['action'] != 'query-attachments'){
        return;
    }
    if(!current_user_can('manage_media_library')){
        $wp_query_obj->set('author', $current_user->ID);
        return;
    }
}

The first two comparisons are made to ensure that the user is a user, that we are on the WP admin page and that we are in the library (query-attachments). The secret lies in the third comparison: By default, the user of role "Author" nay can manage the entire media library (or, in English, Manage the media library - here is the name of Capability). That’s why, !current_user_can('manage_media_library') will be true. At that point, it is said for the object of WP_Query, that one more parameter should be passed to him, that is, the ID user (or "Author") in question. How was used pre_get_posts, this addition is made, and soon after, the query is made. This causes only the images of that specific author to appear in the library.

ADDENDUM

As you want each author to manage only their own shop window, I suppose it’s interesting that authors can also only view their own posts, and no one else’s (by default, WP lets "Author" visualise - but not edit - posts from other authors. My next method eliminates this functionality). For this purpose, the action calling for parse_query. There are other ways to do this, and this is not the most efficient, but it already solves the problem.

The logic is basically the same as the previous one. I check that the user ("Author") nay has powers of role "Editor" and therefore I modify the query to filter only the posts he created. Next

add_action('parse_query', 'restringe_posts' );
function restringe_posts( $wp_query ){
    if ( strpos( $_SERVER[ 'REQUEST_URI' ], '/wp-admin/upload.php' ) !== false || strpos( $_SERVER[ 'REQUEST_URI' ], '/wp-admin/edit.php' ) !== false ) {
        if (!current_user_can('level_5' )){
            global $current_user;
            $wp_query->set('author', $current_user->id);
        }
    }
}

EDIT

To further restrict the result, you can assign other values to query. This is done by using the method again set(). I searched in your source code, and the method only accepts a couple of values at a time, and not an array, as would be more interesting. Therefore, you should call it again. For the case of post_type => product, just include

$wp_query_obj->set('post_type', 'product');

and

$wp_query->set('post_type', 'product');

in each of the two methods, respectively, just below the first occurrence of the method set(). You can include not only the parameter post_type, but all those who Wp_query allows.