Content Restriction doesn’t block custom shortcodes
-
Hi!
I have a page which content is just one custom shortcode
[my-own-shortcode].
Then I have add_shortcode function in my functions.php file that creates a HTML-table by using PHP Echo.I noticed that when I set content restriction from the bottom of the page to a specific role (for example administrator), and then I open this page in incognito window (as logged out user), it still shows my HTML-table. So it executes the shortcode, even the page should only open to administrators. Under the table I see the error message “You don’t have permission to see this content, please log in”.
If I add WP-Members shortcode:
[wpmem_logged_in] [my-own-shortcode] [/wpmem_logged_in]Now it doesn’t show the table at all (so it doesn’t run the shortcode). But if I only select content restriction from the bottom of the page, it doesn’t work.
Is this supposed to work like this?
-
Then I have add_shortcode function in my functions.php file that creates a HTML-table by using PHP Echo.
If your shortcode is echoing content, that’s why the content is not blocked. Your shortcode is improperly constructed and is outputting content to the screen before WP-Members runs its content filter.
A properly contstructed shortcode does not echo content; it returns it. See: https://codex.ww.wp.xz.cn/Shortcode_API#Output
Something like this is a proper shortcode:
add_shortcode( 'my_own_shortcode', 'my_own_shortcode_func' ); function my_own_shortcode_func( $atts = [], $content = null) { // do something to $content $content = "<p>My HTML output</p>"; // always return return $content; }Also, don’t use hyphens in your shortcode tags (i.e. “my-own-shortcode”), use underscores instead (“my_own_shortcode”). See: https://codex.ww.wp.xz.cn/Shortcode_API#Hyphens
The topic ‘Content Restriction doesn’t block custom shortcodes’ is closed to new replies.
