Frontend Media Upload not working for non-admins WordPress

Zac Eckstein comments:

Thanks for you reply. I added your code and then registered a new contributor account and the same behavior is still occurring. Is it possible that there is some other capacity that may have gotten added in reference to the new media manager in WP 3.5? Something similar to upload_files, but.... different or new?

phppoet comments:

can you show the form code which you are using to upload files ?

Zac Eckstein comments:

Well, I'm not using any custom code to upload the files. I'm just using the TinyMCE editor (called with wp_editor) to do all that work for me. Here is the code I'm using to call the editor:

<?php
$content = ((!empty($post_obj->post_content))?$post_obj->post_content:
'');
wp_editor($content, 'userpostcontenteditor');
?>

That displays the editor box with the "add media" link (just like in the back end) which pops up the media library where you can add/edit images and set featured image, etc.

phppoet comments:

Another way is to create a separate upload form from your tinymce. which will work fine . You can use it in following ways . I m giving you one example .

create custom template file with this code in your themes folder .

<?php
/*
Template Name: Custom upload form
*/
?>
<?php
if( 'POST' == $_SERVER['REQUEST_METHOD'] && !empty( $_POST['action'] ) && $_POST['action'] == "new_post") {

// Do some minor form validation to make sure there is content
if (isset ($_POST['title'])) {
$title = $_POST['title'];
} else {
echo 'Please enter the wine name';
}
if (isset ($_POST['description'])) {
$description = $_POST['description'];
} else {
echo 'Please enter some notes';
}

$tags = $_POST['post_tags'];
$winerating = $_POST['winerating'];

// ADD THE FORM INPUT TO $new_post ARRAY
$new_post = array(
'post_title' => $title,
'post_content' => $description,
'post_category' => array($_POST['cat']), // Usable for custom taxonomies too
'tags_input' => array($tags),
'post_status' => 'publish', // Choose: publish, preview, future, draft, etc.
'post_type' => 'post', //'post',page' or use a custom post type if you want to
'winerating' => $winerating
);

//SAVE THE POST
$pid = wp_insert_post($new_post);

//KEEPS OUR COMMA SEPARATED TAGS AS INDIVIDUAL
wp_set_post_tags($pid, $_POST['post_tags']);

//REDIRECT TO THE NEW POST ON SAVE
$link = get_permalink( $pid );
wp_redirect( $link );

//ADD OUR CUSTOM FIELDS
add_post_meta($pid, 'rating', $winerating, true);

//INSERT OUR MEDIA ATTACHMENTS
if ($_FILES) {
foreach ($_FILES as $file => $array) {
$newupload = insert_attachment($file,$pid);
// $newupload returns the attachment id of the file that
// was just uploaded. Do whatever you want with that now.
}

} // END THE IF STATEMENT FOR FILES

} // END THE IF STATEMENT THAT STARTED THE WHOLE FORM

//POST THE POST YO
do_action('wp_insert_post', 'wp_insert_post');

?>

<?php get_header(); ?>

<div id="container">
<div id="content" role="main">

<?php if ( have_posts() ) while ( have_posts() ) : the_post(); ?>

<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
<?php if ( is_front_page() ) { ?>
<h2 class="entry-title"><?php the_title(); ?></h2>
<?php } else { ?>
<h1 class="entry-title"><?php the_title(); ?></h1>
<?php } ?>

<div class="form-content">
<?php the_content(); ?>

<!-- WINE RATING FORM -->

<div class="wpcf7">
<form id="new_post" name="new_post" method="post" action="" class="wpcf7-form" enctype="multipart/form-data">





<!-- images -->
<fieldset class="images">
<label for="bottle_front">Front of the Bottle</label>
<input type="file" name="bottle_front" id="bottle_front" tabindex="25" />
</fieldset>

<fieldset class="images">
<label for="bottle_rear">Back of the Bottle</label>
<input type="file" name="bottle_rear" id="bottle_rear" tabindex="30" />
</fieldset>

<!-- post tags -->

<fieldset class="submit">
<input type="submit" value="Post Review" tabindex="40" id="submit" name="submit" />
</fieldset>

<input type="hidden" name="action" value="new_post" />
<?php wp_nonce_field( 'new-post' ); ?>
</form>
</div> <!-- END WPCF7 -->

<!-- END OF FORM -->
<?php wp_link_pages( array( 'before' => '<div class="page-link">' . __( 'Pages:', 'twentyten' ), 'after' => '</div>' ) ); ?>
<?php edit_post_link( __( 'Edit', 'twentyten' ), '<span class="edit-link">', '</span>' ); ?>
</div><!-- .entry-content -->
</div><!-- #post-## -->

<?php comments_template( '', true ); ?>

<?php endwhile; // end of the loop. ?>

</div><!-- #content -->
</div><!-- #container -->

<?php get_sidebar(); ?>
<?php get_footer(); ?>

<?php

$content = ((!empty($post_obj->post_content))?$post_obj->post_content:

'');

wp_editor($content, 'userpostcontenteditor');

?>

phppoet comments:

and then add these lines at the end of your functions.php

function insert_attachment($file_handler,$post_id,$setthumb='false') {
// check to make sure its a successful upload
if ($_FILES[$file_handler]['error'] !== UPLOAD_ERR_OK) __return_false();

require_once(ABSPATH . "wp-admin" . '/includes/image.php');
require_once(ABSPATH . "wp-admin" . '/includes/file.php');
require_once(ABSPATH . "wp-admin" . '/includes/media.php');

$attach_id = media_handle_upload( $file_handler, $post_id );

if ($setthumb) update_post_meta($post_id,'_thumbnail_id',$attach_id);
return $attach_id;
}

phppoet comments:

don't forget to create page with the custom upload form we created . Subscribers can also upload files using this .

Zac Eckstein comments:

Actually I do currently have a file upload alternative in place using a similar method, but thanks for the example.

I'm attempting to replace that file upload alternative with the wp_editor because I need the functionality of WP's media library so my users can manage all of their media without having to go to the backend, which is why I decided to go with the wp_editor solution in the first place. It's just frustrating that what I have works, but not for any user role except admin. I'm still convinced it's some sort of user capabilities thing.....

Anyway, here is the full text of current page template in case that is helpful to anyone in solving the problem. Warning, it's long and complex.

<?php
/**
* Template Name: New UserPost
*
* A Page template for Submitting User Post
*
*/
if(!is_user_logged_in()){
header("location:". esc_url(home_url('')));
?>
<script type="text/javascript">
window.location = '<?PHP echo esc_url(home_url('')); ?>';
</script>
<?PHP
die('');
}

wp_enqueue_script('jquery');
function add_header(){
?>
<link rel="stylesheet" type="text/css"
href="<?PHP bloginfo('template_directory'); ?>/css/redmond/jquery-ui-1.9.1.custom.min.css" />
<script type="text/javascript" src="<?PHP bloginfo('template_directory') ?>/js/jquery-ui-1.9.1.custom.min.js"></script>
<script type="text/javascript" src="<?PHP bloginfo('template_directory'); ?>/fancybox/jquery.mousewheel-3.0.4.pack.js"></script>
<script type="text/javascript" src="<?PHP bloginfo('template_directory'); ?>/fancybox/jquery.fancybox-1.3.4.pack.js"></script>
<link rel="stylesheet" type="text/css" href="<?PHP bloginfo('template_directory'); ?>/fancybox/jquery.fancybox-1.3.4.css" media="screen" />
<script type="text/javascript">
function show_loading_div(){
data="<p>Uploading your file, one moment...</p>";
data+="<img src=\"<?PHP echo get_bloginfo('template_directory'); ?>/images/ajaxloading_bar.gif\" />";
jQuery('#fancybox-frame').contents().find("#upload_frm").hide();
jQuery('#fancybox-frame').contents().find("#MSG_DIV").html(data);
}
function get_featured_image(){
if(jQuery('#featured_img_id').val()==-1){
return;
}
jQuery('#featured_img_div').html('');
jQuery.ajax({
url:'<?PHP echo get_permalink(); ?>',
data:"featured_img_id=" + jQuery('#featured_img_id').val() + "&req=get_featured_image",
beforeSend:function(){
jQuery('#featured_img_loading').show();
},complete:function(){
jQuery('#featured_img_loading').hide();
},success:function(data){
jQuery('#featured_img_div').html(data);
}
});
}
jQuery().ready(function(){
jQuery('.loading,#featured_img_action').hide();
jQuery('#dialog_message').dialog({
autoOpen:false,
buttons:{
'Ok':function(){
jQuery(this).dialog('close');
}
}
});
jQuery('#cancel_btn').click(function(){
if(jQuery('#post_id').val()==-1){
jQuery('#dialog_message').html('Post has been discarded').dialog('option',{
buttons:{
'Ok':function(){
jQuery(this).html('One moment...');
window.location='<?PHP echo esc_url(home_url('dashboard/')); ?>'
}
}
}).dialog('open');
}else{
jQuery.ajax({
url:'<?PHP echo get_permalink(); ?>',
data:jQuery('#tsv_user_post_form').serialize() + "&req=discard_post",
beforeSend:function(){
jQuery('#submit_loading').show();
},complete:function(){
jQuery('#submit_loading').hide();
},success:function(data){
jQuery('#exe').html(data);
}
});
}
})
jQuery('#upload_img').click(function(){
jQuery.fancybox({
'autoScale' : true,
'transitionIn' : 'none',
'transitionOut' : 'none',
'type' : 'iframe',
'href' : "<?PHP echo esc_url(home_url('image-upload')) ?>?post_id=" + jQuery('#post_id').val()+'&img_id=' + jQuery('#featured_img_id').val() ,
'onClosed' : function(){
get_featured_image();
if(jQuery('#featured_img_id').val()!=-1){
jQuery('#featured_img_action').show()
}
}
});
});
jQuery('#remove_image_btn').click(function(){
jQuery.ajax({
url:'<?PHP echo esc_url(home_url('new-post')); ?>',
data:'req=delete_attach&aid=' + jQuery('#featured_img_id').val(),
beforeSend:function(){
jQuery('#featured_img_div').html('Deleting Image....');
jQuery('#featured_img_action').hide()
},
success:function(data){
jQuery('#featured_img_div').html('');
jQuery('#featured_img_id').val('-1');
},
complete:function(){
jQuery('#remove_image_btn').hide();
}
})
});
jQuery('#user_post_submit,#user_post_preview,#user_post_savedraft').click(function(){
var req;
jQuery('#user_post_content').val(tinyMCE.get('userpostcontenteditor').getContent());
switch(jQuery(this).attr('id')){
case 'user_post_submit':
req='publish';
break;
case 'user_post_savedraft':
req='save_draft';
break;
case 'user_post_preview':
req='post_preview';
break;
}
jQuery.ajax({
url:'<?PHP echo get_permalink(); ?>',
data:jQuery('#tsv_user_post_form').serialize() + "&req=" + req,
beforeSend:function(){
jQuery('#submit_loading').show();
},complete:function(){
jQuery('#submit_loading').hide();
},success:function(data){
//alert(data);
jQuery('#exe').html(data);
}
})
})
});
</script>
<?PHP
}

add_action('wp_head','add_header');
switch($_REQUEST['req']){
case 'delete_attach':
$attachment_id = $_REQUEST['aid'];
wp_delete_post($attachment_id,TRUE);
die('');
break;
case 'discard_post':
$post_id = $_REQUEST['post_id'];
wp_delete_post($post_id,TRUE);
?>
<script type="text/javascript">
jQuery('#dialog_message').html('Post has been discarded').dialog('option',{
buttons:{
'Ok':function(){
jQuery(this).html('One moment...');
window.location='<?PHP echo esc_url(home_url('dashboard/')); ?>'
}
}
}).dialog('open');
</script>
<?PHP
die('');
break;
case 'get_featured_image':
$featured_img = $_REQUEST['featured_img_id'];
echo wp_get_attachment_image($featured_img, array(100,100));
die('');
break;
case 'publish':
case 'save_draft':
case 'post_preview':
$error_flag = FALSE;
$error_message = array();
$post_id = $_REQUEST['post_id'];
$categories = array($_REQUEST['cat']);
$featured_img = $_REQUEST['featured_img_id'];
/**
* Validation Step(s)
*/
if(empty($_REQUEST['user_post_title'])){
$error_flag = TRUE;
$error_msg[]=array( 'key' => 'error_user_post_title', 'value' => __('Please enter a title','tsv'), );
}

elseif(strlen($_REQUEST['user_post_title'])>125){
$error_flag = TRUE;
$error_msg[]=array( 'key' => 'error_user_post_title', 'value' => __('Please enter a title with less then 125 characters','tsv'), );
}


if(empty($_REQUEST['user_post_summary'])){
$error_flag = TRUE;
$error_msg[]=array( 'key' => 'error_user_post_summary', 'value' => __('Please enter a short summary of the post','tsv'), );
}

elseif(strlen($_REQUEST['user_post_summary'])>250){
$error_flag = TRUE;
$error_msg[]=array( 'key' => 'error_user_post_summary', 'value' => __('Please enter a summary with less then 250 characters','tsv'), );
}


if(empty($_REQUEST['user_post_content'])){
$error_flag = TRUE;
$error_msg[]=array( 'key' => 'error_user_post_content', 'value' => __('Please enter some content','tsv'), );
}


if(empty($_REQUEST['cat']) || $_REQUEST['cat']==-1){
$error_flag = TRUE;
$error_msg[]=array( 'key' => 'error_cat', 'value' => __('Please choose a category','tsv'), );
}


if(count($error_msg)>0 && $error_flag){
?>
<script type="text/javascript">
jQuery('.error').html('').hide();
var temp=<?PHP echo json_encode($error_msg); ?>;
for(i=0;i<temp.length;i++)
jQuery('#' + temp[i].key ).show().html(temp[i].value);
jQuery("html,body").animate({ scrollTop: 0 }, "slow");
</script>
<?PHP
} else{
$post_param = array( 'post_content' => $_REQUEST['user_post_content'], 'post_title' => $_REQUEST['user_post_title'],'post_excerpt' => $_REQUEST['user_post_summary'], 'post_type' => 'tsv_userpost', 'tax_input' => array('category'=>$categories) );

if(!empty($_REQUEST['user_post_tags'])){
$post_param['tags_input'] = array_slice(explode(",", $_REQUEST['user_post_tags']),0,5);
}


if($post_id!=-1){
$post_param['ID']=$post_id;
}

/**
* Action Based on The Button Pressed
*/ switch($_REQUEST['req']){
case 'publish':
$post_param['post_status'] = 'publish';
$new_post_id=wp_insert_post($post_param);
?>
<script type="text/javascript">
jQuery('#dialog_message').html('Post published succesfully!').dialog('option',{
buttons:{
'Ok':function(){
jQuery(this).html('One moment....');
window.location='<?PHP echo esc_url(home_url('dashboard')); ?>'
}
}
}).dialog('open');
</script>
<?PHP
break;
case 'save_draft':
$post_param['post_status'] = 'draft';
$new_post_id=wp_insert_post($post_param);
?>
<script type="text/javascript">
jQuery('#post_id').val('<?PHP echo $new_post_id; ?>')
jQuery('#dialog_message').html('Post draft saved').dialog('option',{
buttons:{
'Ok':function(){
jQuery(this).dialog('close');
}
}
}).dialog('open');
</script>
<?PHP
break;
case 'post_preview':
$post_param['post_status'] = 'draft';
$new_post_id=wp_insert_post($post_param);
?>
<script type="text/javascript">
jQuery('#post_id').val('<?PHP echo $new_post_id; ?>')
//jQuery('#dialog_message').html('Loading preview, one moment...').dialog('open');
jQuery('#dialog_message').html('Please click Ok To load Preview').dialog('option',{buttons:{
'Ok':function(){
window.open('<?PHP echo esc_url(home_url('?page_id=' . $new_post_id . '&preview=true')); ?>');
jQuery(this).dialog('close');
}
}}).dialog('open');
/*jQuery('#preview_link').attr({'href':'<?PHP echo esc_url(home_url('?page_id=' . $new_post_id . '&preview=true')); ?>'})
jQuery('#preview_link')[0].click();*/
//window.open('<?PHP echo esc_url(home_url('?page_id=' . $new_post_id . '&preview=true')); ?>');
</script>
<?PHP
break;
}


if($featured_img!=-1){
update_post_meta($new_post_id,'_thumbnail_id',$featured_img);
} else{
delete_post_meta($new_post_id,'_thumbnail_id');
}

}

die('');
break;
}

global $current_user;
get_currentuserinfo();

if(isset($_GET['post_id'])){
$post_id = $_GET['post_id'];
$post_obj = get_post($post_id);

if($post_obj->post_author!=$current_user->ID){
header("location:" . esc_url(home_url('')));
die('');
} else{
$featured_img_id = get_post_meta($post_id,'_thumbnail_id',TRUE);

if(empty($featured_img_id)){
$featured_img_id = -1;
}

}

} else{
$post_id = -1;
// -1 Will be for New Post
$featured_img_id = -1;
}

get_header();
?>
<section id="primary">
<div id="content" role="main">
<?php userpost_menu(); ?>
<form action="" method="post" name="" id="tsv_user_post_form" enctype="multipart/form-data" >
<input placeholder="Enter Your Title..." type="text"
value="<?PHP
echo ((!empty($post_obj->post_title))?$post_obj->post_title:
'');
?>" name="user_post_title" id="user_post_title" class="inputwide" />
Max 125 characters
<div class="error" id="error_user_post_title"></div>
<br />
<input placeholder="Enter short description..." type="text"
value="<?PHP
echo ((!empty($post_obj->post_excerpt))?$post_obj->post_excerpt:
'');
?>" name="user_post_summary" id="user_post_summary" class="inputwide" />
Max 250 characters
<div class="error" id="error_user_post_summary"></div>
<br />
<?php
$cat_ids = array(90,91,92,93,94);
$user_cats = array ( 'include' => implode(",", $cat_ids), //Only shows these 5 categories
'hide_empty' => 0, 'show_option_none' =>'Choose category:', 'sort_by'=>'name', );
$tag_str = NULL;

if(!empty($post_obj)){
$categories = wp_get_post_categories($post_obj->ID);
$tags = wp_get_post_tags($post_obj->ID,array('fields'=>'all'));

if(count($categories)>0){
foreach($categories as $cat) {

if(in_array($cat, $cat_ids)){
$user_cats['selected'] = $cat;
}

}

}


if(count($tags)>0){
foreach($tags as $tag) {
$tag_str[] = $tag->name;
}

$tag_str = implode(",", $tag_str);
}

}

?> <div class="styled-select"> <?php wp_dropdown_categories($user_cats); ?></div><?php
?>
<div class="error" id="error_cat"></div>
<br />
<input class="cbutton" type="button" id="upload_img" value="Add/Switch Featured Image" />
<div style="margin-top:10px;" id="featured_img_loading" class="loading">
<img src="<?PHP bloginfo('template_directory'); ?>/images/ajaxloading-circul.gif" />
</div>
<div id="featured_img_ct" style="position:relative">
<div style="margin-top:10px;" id="featured_img_div">
<?PHP

if($featured_img_id!=-1){
echo wp_get_attachment_image($featured_img_id, array(150,150));
}

?>
</div>
<div id="featured_img_action" style="position:absolute;top:10px;left:100px;">
<img src="<?PHP bloginfo('template_directory'); ?>/images/b_drop.png" id="remove_image_btn" style="cursor:pointer;" />
</div>
</div>
<br /><br />
<input type="hidden" value="<?PHP echo $post_id; ?>"
name="post_id" id="post_id" />
<input type="hidden" value="<?PHP echo $featured_img_id; ?>"
name="featured_img_id" id="featured_img_id" />
<input type="hidden" name="user_post_content" id="user_post_content" />
<label>Tags:</label>
<input placeholder="Seperated by commas" type="text"
value="<?PHP
echo ((!is_null($tag_str)?$tag_str:
''));
?>"
name="user_post_tags" id="user_post_tags" /> (note: Only first 5 tags will be saved)
<br />
Popular tags: <?php wp_tag_cloud(); ?>
<br /><br />
<?php
$content = ((!empty($post_obj->post_content))?$post_obj->post_content:
'');
wp_editor($content, 'userpostcontenteditor');
?>
<div class="error" id="error_user_post_content"></div>
<br /><br />
<div class="loading" id="submit_loading">
<img src="<?PHP bloginfo('template_directory'); ?>/images/ajaxloading_bar.gif" />
</div>
<div class="submit_div">
<input class="cbutton" type="button" name="submit_btn" id="user_post_submit" value="<?PHP
echo ((!empty($post_obj))?'Update':
'Publish');
?>">
<input class="cbutton" type="button" name="submit_btn" id="user_post_savedraft" value="Save Draft">
<input class="cbutton" type="button" name="submit_btn" id="user_post_preview" value="Preview">
<input class="cbutton" type="button" value="Discard" name="cancel" id="cancel_btn" />
</div>
<br />
</form>
</div><!-- #content -->
</section><!-- #primary -->
<?PHP

if($featured_img_id!=-1){
add_action('wp_footer','add_wp_footer');
}


function add_wp_footer(){
?>
<script type="text/javascript">
jQuery().ready(function(){
jQuery('#featured_img_action').show();
});
</script>
<?PHP
} ?>
<div id="dialog_message"></div>
<div style="display:none" id="for_preview">
<a id="preview_link" target="_blank"></a>
</div>
<?php get_sidebar('newpost'); ?>
<?php get_footer(); ?>

phppoet comments:

It looks like a bug in wordpress 3.5 .


problem lies somewhere in wp-admin/upload.php. i will update post if i found a solution

Zac Eckstein comments:

Yeah, I'm beginning to think you're right. I'm going to look around upload.php as well and see if I can find anything that fixes it.

phppoet comments:

Another way is to disable main role capabilities for editor and choose default registration as editor. It will work for editor . but you need disable important attributes for editor.

phppoet comments:

Problem is with the root wordpress core .

wordpress now treats media in a way they treat their posts ,pages and custom post types . therefore only a user role with following attributtes can upload media.

Edit others pages

Edit others posts

Edit published pages

Edit published posts

Upload files

Read

subscriber role with these attributes will work for you but it is not advisable to give subscribers such a attributes . At the end i thing downgrading to 3.4 would be a good idea untill this issue solved in future versions .

phppoet comments:

I found one solution .


Give subscribers this three attributes .


Upload files

Edit published pages

Edit others pages

. Subscribers now can upload media but cant access admin dashboards , Can edit pages but you can remove admin bar so that they can't see edit page link.

Zac Eckstein comments:

Hmmm, I think you're on the right track but no matter what capabilities I give the role, it's still doing it. Just to make sure, does this code look right in my functions file to add capabilities to the contributor role?

function update_caps() {
$role = get_role( 'contributor' );

$caps_to_add = array(
'edit_others_pages',
'edit_published_pages',
'upload_files'
);

foreach( $caps_to_add as $cap )
$role->add_cap( $cap );
}


phppoet comments:

I m using http://wordpress.org/extend/plugins/capsman/ this plugin and i given 3 capabilities to subscribers .

Upload files

Edit published pages

Edit others pages

and your above given code is working for me . Big minus point of this is that users can edit pages . I think you need to find some solution for it like hiding pages or removing pages or not using pages .


rather then putting above code into functions.php you should use this plugin

http://wordpress.org/extend/plugins/capsman/

no need to add any code to functions.php

just give three capibilities to subscriber and you will see it working

Zac Eckstein comments:

Very strange. Following your steps exactly, it's still not working.

Anyway, I agree that it's a Wordpress bug and I will most likely downgrade to 3.4 until something gets fixed. I'm going to keep playing with it thought to see if I can at least replicate your success. In the meantime, you deserve the money for your answer so I'll go ahead and reward it to you.

Thanks for you time on this one, it's a strange one for sure!

Zac Eckstein comments:

Just had a thought. I'm posting to a custom post type. I wonder if that has anything to do with it?