Practical example 02
Allow signed-in users to edit existing posts from a site-facing form instead of the WordPress admin screen. The target post is identified with post_id, then the template checks its post type and edit capability.
post_id from an edit link to identify the target post.edit_post capability to decide whether saving is allowed.For new posts, see the new-post form example. This page focuses only on editing existing posts.
Add this to the theme's functions.php or a site-specific plugin. Existing-post editing receives a post_id, so use current_user_can( 'edit_post', $post_id ).
<?php
add_filter(
'cfs_form_can_save',
function ( $can_save, $post_id, $post_data ) {
if ( ! is_user_logged_in() ) {
return false;
}
if ( 0 < $post_id ) {
return current_user_can( 'edit_post', $post_id );
}
return false; // This page does not allow new-post creation.
},
10,
5
);This example uses a page with the slug front-form-edit.
<?php
add_action( 'wp_enqueue_scripts', function () {
if ( is_page( 'front-form-edit' ) && is_user_logged_in() ) {
CFS()->form->load_assets();
}
} );From an archive page, account page, or single post page, link to the form page with a post_id query parameter.
<?php
$edit_url = add_query_arg(
array(
'post_id' => get_the_ID(), // Existing post ID to edit.
),
home_url( '/front-form-edit/' ) // Page that contains the form.
);
?>
<a href="<?php echo esc_url( $edit_url ); ?>">Edit this entry</a>If post_id is missing, there is no edit target, so return 404 or 403. After checking the post type and edit capability, pass the ID to CFS()->form().
<?php
/* Template Name: CFS Front-end Edit Form */
if ( ! is_user_logged_in() ) {
auth_redirect();
}
$post_id = absint( $_GET['post_id'] ?? 0 );
$post_type = 'member_entry'; // Post type allowed for editing.
if ( ! $post_id ) {
wp_die( 'No post was selected for editing.', '', array(
'response' => 404,
) );
}
// Prevent a different post type from being selected through the URL.
if ( $post_type !== get_post_type( $post_id ) ) {
wp_die( 'This post type is not allowed.', '', array(
'response' => 404,
) );
}
// Confirm that the current user may edit this post.
if ( ! current_user_can( 'edit_post', $post_id ) ) {
wp_die( 'You are not allowed to edit this post.', '', array(
'response' => 403,
) );
}
get_header();
?>
<main class="front-form">
<h1>Edit entry</h1>
<?php
echo CFS()->form( array(
'post_id' => $post_id, // Update this existing post.
'field_groups' => array( 123 ), // Field group ID.
'submit_label' => 'Save',
'confirmation_url' => get_permalink( $post_id ),
) );
?>
</main>
<?php get_footer(); ?>For member-submitted content, you may want users to edit only posts they authored. Add an author check on top of the capability check.
<?php
$owner_id = (int) get_post_field( 'post_author', $post_id );
if ( get_current_user_id() !== $owner_id ) {
wp_die( 'You are not allowed to edit this post.', '', array(
'response' => 403,
) );
}An author-only check can also block administrators. Decide whether current_user_can( 'edit_post', $post_id ) should be enough, or whether the form must be limited to the post owner.
post_id is missing.