List of post to edit in frontend

Hello,

Finally I create a list-page with a table in html with a list of one of my custom post type.
In each post row I put in one column the link to edit the post.

I put the shortcode in 3 places:

--> 1 Place:
I create a page named crear-articulo (to create) with the shortcode:
[mb_frontend_form post_type="articulo" edit="true" id="organizacion" post_fields="title,content" label_title="Título" submit_button="Dar de alta el artículo"]

--> 2 Place:
I create a page named modificar-articulo (to update) with the shortcode:
[mb_frontend_form post_type="articulo" edit="true" id="organizacion" post_fields="title,content" label_title="Título" submit_button="Dar de alta el artículo" post_id="current"]

--> 3 Place:
I add a filter to add after the $content the shortcode to can update the actual post:
[mb_frontend_form post_type="articulo" edit="true" id="organizacion" post_fields="title,content" label_title="Título" submit_button="Dar de alta el artículo" post_id="current"]

To edit the post, I have some options?

--> 1 Option: Put in each row the link to the same page to create de post:

`$link = home_url( '/crear-articulo/' );
$link = add_query_arg( 'rwmb_frontend_field_post_id', $post->ID, $link );        
return '<a href="'.$link.'">Editar</a>';`

--> 2 Option: Put in each row the link to the update post page:

`$link = home_url( '/modificar-articulo/' );
$link = add_query_arg( 'rwmb_frontend_field_post_id', $post->ID, $link );        
return '<a href="'.$link.'">Editar</a>';`

Questions:
- What is the best option? Am I doing well so far?
- With the option 1, I only have to create one page to create and update posts. But I have a issue with the shortcodes. In the content field of the create page, the shortcodes are not shown, they are already half solved:
Ex: It appear this the text but not the shortcode...
Título del spoiler
Contenido oculto
Título del spoiler
Contenido oculto
Título del spoiler
Contenido oculto

But in the update page, the shortcodes are displayed well, as in the backoffice editor:

[su_accordion class=""]
[su_spoiler title="Título del spoiler" open="no" style="default" icon="plus" anchor="" class=""]Contenido oculto[/su_spoiler] 
[su_spoiler title="Título del spoiler" open="no" style="default" icon="plus" anchor="" class=""]Contenido oculto[/su_spoiler] 
[su_spoiler title="Título del spoiler" open="no" style="default" icon="plus" anchor="" class=""]Contenido oculto[/su_spoiler] 
[/su_accordion]

The same issue have in the shortcode situated in the 3 place.

Many Thanks.

No, everything works fine. Another question:

Someone who knows:
http://xxx.es/crear-articulo/?rwmb_frontend_field_post_id=540

Knowing this url and changing the post id, anyone can enter and update all the posts...

What people do to solve it?

I think one solution is make a function wiht the add_action('template_redirect',
and check that the user has permission to modify the post id.

I don't know if to do this, is important this code, that I don't understand very well:

add_filter( 'rwmb_frontend_field_value_post_id', 'my_custom_population_function', 10, 2 );
function my_custom_population_function( $value, $args ) {
    if ( $args['id'] === 'your_meta_box_id' ) { // Only filter for a specific form.
        $value = 123;
    }
    return $value;
}

I can see the args printed in the page, but when I call the action template_redirect, or the arguments are not yet, or I do not know how to collect them.

Is there any easier solution? Or does it have to be done this way?

Thanks,
Sergio

ok thanks, but to use template_redirect, how can I get the post_id to check if is_author o another rule? Because I can have the post_id of the page that contains the shortcode to update the post, but the post_id of the post to update is in the end of the url.

http://xxx.es/crear-articulo/?rwmb_frontend_field_post_id=540

?

Thanks.