I have created a kind of a social network where when a user registration happens, I create a post (custom post type follower) for each user and assign its post_id to the user ( update_user_meta($current_user->ID, ‘post_id’, $new_post_id ) ) and set the role as subscriber.
Each user has its own profile page which is shown on his post page (single.php). Obviously each user can only edit his own profile and therefore I need a way to verfiy if the $current_user->post_id === current_page_post_id, when doing the changes through ajax.
So far I was passing the current page post_id through jQuery ajax object(wp_localize_script) and retriving that in my php ajax function, to do the verfication but today I realized that its easy to change the post_id from console and its not safe to rely on javascript object value because it can be tempered. If somebody changes the value of my javascript postId object from console they can edit any profile they want.
So is there any way of making the current page post_id available in the function hooked to wp_ajax so I can do server side validation and verfiy if the current_user’s post_id is equal to the post_id of the page he is editing. Or is there any work around through current_user_can() function so I can check if the current user has the right to make changes to the current post.
I have read the similar answer here Getting the post_id in wp_ajax function however my question is not just limited to getting the post_id within the ajax hook.








