Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a few sites in a network. I don't want the site administrators to manage things like network plugins, but I would like them to be able to edit profiles of all network users, not use those on their site.

At the top of the /wp-admin/network/users.php file is this:

if ( ! current_user_can( 'manage_network_users' ) )
    wp_die( __( 'You do not have permission to access this page.' ) );

How can I grant site administrators priviledges to manage_network_users without promoting them to Super Admin?

Here's what the code is looking like:


/**
 * Retrieve a list of super admins.
 *
 * @since 3.0.0
 *
 * @uses $super_admins Super admins global variable, if set.
 *
 * @return array List of super admin logins
 */
function get_super_admins() {
    global $super_admins;

    if ( isset($super_admins) )
        return $super_admins;
    else
        return get_site_option( 'site_admins', array('admin') );
}

/**
 * Determine if user is a site admin.
 *
 * @since 3.0.0
 *
 * @param int $user_id (Optional) The ID of a user. Defaults to the current user.
 * @return bool True if the user is a site admin.
 */
function is_super_admin( $user_id = false ) {
    if ( $user_id )
        $user = new WP_User( $user_id );
    else
        $user = wp_get_current_user();

    if ( empty( $user->id ) )
        return false;

    if ( is_multisite() ) {
        $super_admins = get_super_admins();
        if ( is_array( $super_admins ) && in_array( $user->user_login, $super_admins ) )
            return true;
    } else {
        if ( $user->has_cap('delete_users') )
            return true;
    }

    return false;
}

    /**
     * Whether user has capability or role name.
     *
     * This is useful for looking up whether the user has a specific role
     * assigned to the user. The second optional parameter can also be used to
     * check for capabilities against a specfic post.
     *
     * @since 2.0.0
     * @access public
     *
     * @param string|int $cap Capability or role name to search.
     * @param int $post_id Optional. Post ID to check capability against specific post.
     * @return bool True, if user has capability; false, if user does not have capability.
     */
    function has_cap( $cap ) {
#       fb($cap);
        if ( is_numeric( $cap ) ) {
            _deprecated_argument( __FUNCTION__, '2.0', __('Usage of user levels by plugins and themes is deprecated. Use roles and capabilities instead.') );
            $cap = $this->translate_level_to_cap( $cap );
        }

        $args = array_slice( func_get_args(), 1 );
        $args = array_merge( array( $cap, $this->ID ), $args );
        $caps = call_user_func_array( 'map_meta_cap', $args );

        // Multisite super admin has all caps by definition, Unless specifically denied.
        if ( is_multisite() && is_super_admin( $this->ID ) ) {
            if ( in_array('do_not_allow', $caps) )
                return false;
            return true;
        }

        // Must have ALL requested caps
        $capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args );
        $capabilities['exist'] = true; // Everyone is allowed to exist
        foreach ( (array) $caps as $cap ) {
            //echo "Checking cap $cap
"; if ( empty( $capabilities[$cap] ) || !$capabilities[$cap] ) return false; } return true; }

Code from users.php in wp-admin showing a second capability check for editing network users:

// Only allow super admins on multisite to edit every user.
if ( is_multisite() && ! current_user_can( 'manage_network_users' ) && $user_id != $current_user->ID && ! apply_filters( 'enable_edit_any_user_configuration', true ) )
    wp_die( __( 'You do not have permission to edit this user.' ) );

share|improve this question
    
possible duplicate of How to add a Capability to a User Role? –  kaiser Jun 28 '11 at 20:10
1  
I do not believe this to be a duplicate. It is a fairly hard question as some of the network user admin functions are coded in a way that seems to make it very hard to extend them. –  cwd Jun 30 '11 at 3:20
    
@cwd You want to add a capability (you name it "priviledges") to a role. Administrator (or Site Administrator) is a role. And manage_network_users is a capability. So "How can I grant site administrators priviledges to manage_network_users without promoting them to Super Admin?" means "How can I add the capability of manage_network_users to the role of 'administrator'". Same Q, same solution = dublicate. Further reading material here in the Codex. –  kaiser Jun 30 '11 at 4:03
1  
I already tried using the "Members" plugin to simply add the capability "manage_network_users" for Administrators, but it did not work. Simply adding the capability in that fashion won't solve the whole problem as there are other checks in place for network capabilities. I'm not sure if you can tell from the code I've added above, but the Super Administrator role / capabilities work quite differently from the others. A solution that does not work is not a solution. –  cwd Jun 30 '11 at 11:57
    
@cwd: consider opening a ticket: core.trac.wordpress.org –  scribu Jun 30 '11 at 13:30
show 3 more comments

1 Answer

up vote 2 down vote accepted

Here's a solution that worked for me:

http://thereforei.am/2011/03/15/how-to-allow-administrators-to-edit-users-in-a-wordpress-network/

Pretty elegant and doesn't involve messing with core.

share|improve this answer
    
Thanks - that looks like it will do the trick! –  cwd Nov 29 '11 at 22:54
    
You may want to test first before accepting, as other users with this problem will see this too –  Tom J Nowell Nov 21 '12 at 12:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.