Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have set up a WordPress site for a client. The client has the Editor role, however I have installed the Members plugin and given the client the capability to add new users to the WP admin. This is working just fine.

The question I have is that I would like for the client to have the ability to create new user as with the roles of a Contributor, Subscriber, Editor and Author, but NOT Administrator. The new users the client creates should not have the Administrator role. Is it possible to hide this option somehow?

Thanks Vayu

share|improve this question
1  
Please link the plugin you're using, I had problems to find out which one you are referring to. –  hakre Nov 24 '10 at 12:22

1 Answer 1

It's actually pretty easy. You need to filter into map_meta_caps and stop editors from creating/editing admins, and remove the administrator role from the 'editable roles' array. This class, as a plugin or in your theme's functions.php file would do it:

class JPB_User_Caps {

  // Add our filters
  function JPB_User_Caps(){
    add_filter( 'editable_roles', array(&$this, 'editable_roles'));
    add_filter( 'map_meta_cap', array(&$this, 'map_meta_cap'),10,4);
  }

  // Remove 'Administrator' from the list of roles if the current user is not an admin
  function editable_roles( $roles ){
    if( isset( $roles['administrator'] ) && !current_user_can('administrator') ){
      unset( $roles['administrator']);
    }
    return $roles;
  }

  // If someone is trying to edit or delete and admin and that user isn't an admin, don't allow it
  function map_meta_cap( $caps, $cap, $user_id, $args ){

    switch( $cap ){
        case 'edit_user':
        case 'remove_user':
        case 'promote_user':
            if( isset($args[0]) && $args[0] == $user_id )
                break;
            elseif( !isset($args[0]) )
                $caps[] = 'do_not_allow';
            $other = new WP_User( absint($args[0]) );
            if( $other->has_cap( 'administrator' ) ){
                if(!current_user_can('administrator')){
                    $caps[] = 'do_not_allow';
                }
            }
            break;
        case 'delete_user':
        case 'delete_users':
            if( !isset($args[0]) )
                break;
            $other = new WP_User( absint($args[0]) );
            if( $other->has_cap( 'administrator' ) ){
                if(!current_user_can('administrator')){
                    $caps[] = 'do_not_allow';
                }
            }
            break;
        default:
            break;
    }
    return $caps;
  }

}

$jpb_user_caps = new JPB_User_Caps();

EDIT

Ok, so I took a look into why it was letting user deletion slip through. It looks like delete_user is handled slightly differently from edit_user; I've modified the map_meta_cap method to work around this. I've tested on 3.0.3 and this will prevent anybody but administrators from actually deleting, editing, or creating an administrator.

share|improve this answer
    
Excellent! Thanks John, that worked perfectly! –  Vayu Nov 26 '10 at 10:04
    
Can someone verify that this code prevents others from deleting admins? I can't reproduce that behaviour. It does prevent them from editing, but the "delete" hover link still appears, and WP allows the user to go through with the deletion... –  somatic Dec 15 '10 at 12:47
    
@somatic - you were spot on. Thanks for pointing that out. The issue is fixed now. –  John P Bloch Dec 20 '10 at 17:24
    
i need to do this also but unsure where i put this code! In the functions.php? If not how could it be done to work from the functions.php? best, Dc –  daniel Crabbe Jul 27 '11 at 12:16
    
@daniel read the first paragraph. –  John P Bloch Jul 27 '11 at 14:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.