[Plugin: O3World Members-Only Categories] Posts are not private

re: #1, i was only able to replicate this issue by adding a post to both a public and private category… as long as your posts are in mutually-exclusive sets, everything works fine; just tested on a fresh install of wordpress 3.4.1 running the twentyeleven theme.

in other words, if a post is meant to be seen by anyone, then Do Not assign it to any private category.

re: #2 it’s definitely true that you can assign each post to as many private categories as appropriate. in my test i created three categories (public, private one, private two) and four posts (one each for the three categories, and a fourth assigned to both private categories) and two test users with access only to private one or two. they each see 3 of those four posts.

re: #3 our use case didn’t require private/public pages but it’s an interesting thought!

Thanks for your response Kris. One quick question for you. In your testing, have you tried accessing a page directly? If I am able to ever see a heading for a post (not via category but by posts themselves), I’m able to navigate to the otherwise “private” post. Likewise, if I have the url (post ID), and I enter it in the address bar, it shows up. Are you able to test this on your end to see if this works for you? On my end, things sort of work as you’ve described, except that I’ve found quite a few ways around it (entering in a post ID manually, a plugin on a page that displays all posts in a category (which shows the posts and then allows you to click on the title to view them). If this plugin actually stopped a user from navigating to the post if they didn’t have access, we’d be golden.

Thanks and I look forward to your feedback.

your concerns are entirely valid. someone else had similar issues discovered by inclusion of the ‘recent comments’ widget in the sidebar, which appears to disregard the filtering of posts by the pre_get_posts hook on which this plugin entirely relies…

our limited use case was to show content relevant to one set of users versus another on a ‘sales team portal’… that site required login to view anything, so i wasn’t concerned with access control on a per-post basis.

with that said, it makes sense to me now the more general need to redirect to the login page if attempting to access a post that is deemed ‘private’.

Is that a bit of difficult code to add? You’re obviously the expert here since you built the plugin ?? Thanks for your prompt responses, definitely appreciated.

Hi there

Do you know of a way to generate a table of contents that only shows pages that the logged-in user has access to?

I’d be happy to pay for this if there isn’t an existing solution.

Justin

Hi,

I have the same problem. A post which belongs to a private category is still visible by a non-logged user if he accesses directly by the post URL.
Do you intend to enhance your plugin by sending a 404 error in this case?
Thanks.