Skip to content

Hide role-restricted blocks, widgets and menu items from unpaid users - #559

Merged
polevaultweb merged 4 commits into
developfrom
fix/unpaid-block-restriction
Nov 3, 2026
Merged

polevaultweb merged 4 commits into
developfrom
fix/unpaid-block-restriction

Conversation

@polevaultweb

@polevaultweb polevaultweb commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

A user who registered on a paid Stripe form and never paid could see blocks, legacy widgets and menu items restricted to their role. The Stripe integration withholds an unpaid account's roles through wpum_get_user_access_roles(), and the shortcode and Elementor restrictions use it, but these three checks read $user->roles directly.

Changes

  • Menu items: role visibility uses wpum_get_user_access_roles() (includes/admin/class-wpum-menus.php).
  • Blocks and legacy widgets: fixed in wpum-blocks (WPUserManager/wpum-blocks#55), released as 1.16. composer.json and composer.lock now require 1.16.

Tests

In tests/wpunit/Stripe/UnpaidCapabilitiesTest.php:

  • test_unpaid_user_does_not_see_role_restricted_block: hidden for an unpaid subscriber, shown once paid, hidden for another role.
  • test_unpaid_user_does_not_see_role_restricted_widget: hidden while unpaid, shown once paid.
  • test_unpaid_user_does_not_see_role_restricted_menu_item: hidden while unpaid, shown once paid.

Reported by elba.code via Patchstack.

🤖 Generated with Claude Code

polevaultweb and others added 4 commits November 3, 2026 08:54
Menu item role visibility now uses wpum_get_user_access_roles(), as the
shortcode and Elementor restrictions do, so the Stripe integration can
withhold roles while a payment is outstanding. Tests cover menu items,
blocks and legacy widgets; the block and widget checks live in
wpum-blocks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ing)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@polevaultweb
polevaultweb merged commit c7a051c into develop Nov 3, 2026
3 checks passed
@polevaultweb
polevaultweb deleted the fix/unpaid-block-restriction branch November 3, 2026 12:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant