Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm currently developing an intranet and I am using Justin Tadlock's Members plugin to control roles and capabilities.

I have created a HR role to allow Human Resources staff to create and edit user accounts. All staff created in WP are given the contributor role with a select few members of staff given editor and administrator roles.

What I want is to stop staff from logging in and changing their own profile information. Only staff of the HR role should be able to edit profile information.

share|improve this question

3 Answers 3

great answer, to take this a step further and for anyone looking to apply this to all non-admin users (e.g. contributers, editors etc.)

// ===== remove edit profile link from admin bar and side menu and kill profile page if not an admin
if( !current_user_can('activate_plugins') ) {
function mytheme_admin_bar_render() {
    global $wp_admin_bar;
    $wp_admin_bar->remove_menu('edit-profile', 'user-actions');
}
add_action( 'wp_before_admin_bar_render', 'mytheme_admin_bar_render' );

function stop_access_profile() {
    if(IS_PROFILE_PAGE === true) {
        wp_die( 'Please contact your administrator to have your profile information changed.' );
    }
    remove_menu_page( 'profile.php' );
    remove_submenu_page( 'users.php', 'profile.php' );
}
add_action( 'admin_init', 'stop_access_profile' );
}
share|improve this answer
up vote 2 down vote accepted

Worked it out with a bit of time. Here is the code I am using:

<?php
/*
Plugin Name: Restrict User Editing Own Profile
Plugin URI: http://www.philosophydesign.com
Description: Restricts users from editing their own profile information.
Author: Scott Cariss
Version: 0.1
Author URI: http://www.philosophydesign.com/scott-cariss.html
*/

add_action( 'admin_menu', 'stop_access_profile' );
function stop_access_profile() {
    remove_menu_page( 'profile.php' );
    remove_submenu_page( 'users.php', 'profile.php' );
    if(IS_PROFILE_PAGE === true) {
        wp_die( 'You are not permitted to change your own profile information. Please contact a member of HR to have your profile information changed.' );
    }
}
?>

The above code stops anyone from editing their own profile information despite who they are. People who have the ability to create and edit uses can still do so but cannot alter their own.

share|improve this answer

Solution as a (MU-)Plugin

I checked all the provided solutions and thought I could make a nice MU-Plugin out of it. The only real change is that it avoids

<?php
! defined( 'ABSPATH' ) AND exit;
/**
 * Plugin Name: Disable profile page link
 * Description: Remove edit profile link from admin bar and side menu and kill profile page if user isn't an administrator.
 */
# Version: 2012-09-15.2245

function oxo_stop_access_profile()
{
    // Remove AdminBar Link
    if ( 
        'wp_before_admin_bar_render' === current_filter()
        AND ! current_user_can( 'manage_options' )
    )
        return $GLOBALS['wp_admin_bar']->remove_menu( 'edit-profile', 'user-actions' );

    // Remove (sub)menu items
    remove_menu_page( 'profile.php' );
    remove_submenu_page( 'users.php', 'profile.php' );

    // Deny access to the profile page and redirect upon try
    if ( 
        defined( 'IS_PROFILE_PAGE' )
        AND IS_PROFILE_PAGE
        AND ! current_user_can( 'manage_options' )
        )
    {
        wp_redirect( admin_url() );
        exit;
    }
}
add_action( 'wp_before_admin_bar_render', 'oxo_stop_access_profile' );
add_action( 'admin_init', 'oxo_stop_access_profile' );
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.