acpt/form/authorize_submission

Allow or reject a whole front-end form submission before anything is saved

Type: Filter

Available since ACPT 2.1.1.

Runs when a visitor submits one of your front-end forms, after validation and before anything is written to the database (posts, terms, users, meta fields, custom content type records). Use it to plug your own authorization rules into ACPT Forms, for example to require a WordPress capability before a form can create or edit content.

Return a WP_Error (or false) to reject the submission: nothing is saved, no email is sent and the error message is shown on the form.

Parameters

Parameter	Type	Description
$allowed	bool|WP_Error	true by default
$form	FormModel	The form being submitted
$data	array	The sanitized submitted values, one entry per form field (id, name, type, value, extra, …)
$target	array	What the submission writes to: action (the form action, e.g. FILL_META or FILL_TABLE), postId, termId, userId, recordId (each null when not set)

Return: true to allow the submission, false or a WP_Error to reject it. With a WP_Error, its message is shown to the visitor.

Usage

use ACPT\Core\Models\Form\FormModel;

add_filter("acpt/form/authorize_submission", function($allowed, FormModel $form, array $data, array $target){
    // only users who can publish posts may use the "Submit an article" form
    if ($form->getName() === 'submit-article' && !current_user_can('publish_posts')) {
        return new WP_Error('acpt_not_allowed', 'You are not allowed to submit articles.');
    }

    return $allowed;
}, 10, 4);

What ACPT already checks

Before this filter runs, ACPT has already applied its own rules:

• the form's Submission limits;

• edit_post, edit_term or edit_user when the form updates an existing post, term or user;

• the create/update permissions of a custom content type table the form writes a record to;

• the permissions of each field or table column (see acpt/form/authorize_field).

Creating a new post is not tied to a WordPress capability, so that guest submission forms keep working. If you want to require one, do it with this filter.