Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

By default, I am allowing people to subscribe as contributors to my site which allows them certain actions.

What I then want to do is remove Posts, Comments, Contact (ContactForm7) and Tools leaving them only options to add new Events (events plugin).

I also want to be sure that even though these buttons are hidden, people cannot submit to these PostTypes if they knew how to.

I am reading through the Professional WordPress plugins development book at the moment and it's a lot to take in so I'd like to do this just in my theme's functions page for now.

Here's what I am trying according to the codex:

    add_action( 'admin_menu', 'jh_remove_menu_pages' );
    function jh_remove_menu_pages() {
        remove_menu_page('edit-comments.php');  
        remove_menu_page('tools.php');  
        remove_menu_page('edit.php');   
        remove_menu_page('wp-contact-form-7.php');  
    }

I've managed to do a find on this page to fins all the php files I need to hide but I am not sure about the ContactForm7 file. EDIT: Managed to find solution here to remove Contact Form 7 from Admin Menu

According to the codex though, the code above does not remove the permissions for them to access the screens (posts, tools etc) directly and still submit if they knew how: "Please be aware that this would not prevent a user from accessing these screens directly. Removing a menu does not replace the need to filter a user's permissions as appropriate."

How would I remove the capabilities of all the above except the for Events and Profile? I'm reading through remove_cap in the codex, but I am concerned that I might inadvertently switch off posting Events if I remove the Posts capability?

And lastly, how do I show only the related Events for the user who is logged in at the time?

Many thanks.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

In your case best solution is create your own custm role and assign them only the capabilities you users need. Regarding wordpress, for what I can understand from your question the only cabability you should give them is read.

In this way they will see only the profile. Problems start with the plugin, you don't say (or I don't understand) which is the plugin you are using so I can't give better help.

Consider that a lot depends on how plugin is coded: if it checks for some standard capabilities, e.g. you find in the code something like

if ( currrent_user_can('edit_posts') ) { // do stuff

it means that to make it work you have to assign the edit_posts cap to your role. But this is a problem: if you assign that capability the Postmenu in admin will be shown. Of course you can remove that using remove_menu_page, but as you said in question, this not prevent user access directly to that admin screens if they know how to do.

So what I suggest you is:

  1. Create your role, start with assign to that only the read cap
  2. See docs for your plugin and/or look at the code to understand wich capabilities is required to make it works.
  3. Add these required capabilities to your role. If some standard caps are required, (and so some standard menu will be shown, remove them with remove_menu_page
  4. In that case, to prevent direct access, thanks to the fact you have created a custom role, you can prevent the access to admin screen hooking into load-{$page} action and prevent access to your custom role.
  5. In backend, got to Settings -> General and make 'Custom Role' as New User Default Role

How To

1) Create Role

$subscriber = get_role( 'subscriber');
$plugin_caps = array('edit_posts', 'cap_required_by_event_plugin');
$all_caps = array_merge($subscriber->capabilities, $plugin_caps);
add_role('custom_role', 'Custom Role', $all_caps );

2) Understand the capability required by plugin

Look at plugin docs. Do a multiple file search into the plugins folder, searching for keywords like 'current_user_can', 'user_can', 'has_cap'. If you have problem try to ask on plugin support forum (if exists), ask here and google it. Developer is and hard work! ;)

3) Add required capabiliest to your role

Easiest way is just add the required cap to the $plugin_caps array defined on point 1).

4) Prevent access to screen even if the capability is attached to custom role

Assuming you have to add the edit_posts cap to your role in order to make event plugin works. First of all remove the menu.

add_action( 'admin_menu', 'custom_remove_menu_pages' );

function custom_remove_menu_pages() {
  $user = wp_get_current_user();
  if ( in_array('custom_role', $user->roles) ) {
    remove_menu_page('edit-comments.php');  
    remove_menu_page('tools.php');  
    remove_menu_page('edit.php'); 
  }
}

Then prevent access:

add_action( 'load-edit.php', 'custom_prevent_admin_access' );
add_action( 'load-tools.php', 'custom_prevent_admin_access' );
add_action( 'load-post.php', 'custom_prevent_admin_access' );
add_action( 'load-post-new.php', 'custom_prevent_admin_access' );

function custom_prevent_admin_access() {
  $user = wp_get_current_user();
  if ( in_array('custom_role', $user->roles) ) {
    wp_die("Sorry, you can't stay here.");
    exit();
  }
}

5) Set 'Custom Role' as New User Default Role

enter image description here


That's all, hope it helps.

share|improve this answer
    
Wow G.M. thanks for the in depth explanation. I had dabbled with a number of plugins to create new roles but being new to roles a capabilities, I felt a bit lost despite all the reading I have done. I will try and implement these changes now and get back to you ;) Once again, thank you. –  SixfootJames Sep 8 '13 at 5:16
    
Hi GM. I have done a search on this plugin now and managed to find two places it mentions capabilities. What I have found is if statements like this: if (!current_user_can('edit_post', $post_id)) and elseif (!current_user_can('edit_page', $post_id)). So I assume then the capabilities would be edit_post and edit_page? –  SixfootJames Sep 28 '13 at 12:51
    
Hi GM. I've sat for awhile now trying to figure this out and if I go the Subscriber route .i.e $subscriber = get_role( 'subscriber'); then I cannot seem to get the plugin's button to appear. If however I create default user a contributor, the button appears and I can hide what I don't need. Also, perhaps the contributor route is better to go because as I understand it, that way, people can add content but not publish which is what I need. –  SixfootJames Sep 28 '13 at 13:16
    
Hi GM, I eventually decided to go the contributor route which is working really well for me. Thanks for all the information you gave. –  SixfootJames Sep 29 '13 at 10:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.