Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm perplexed; I can't see where I'm going wrong with this code. It should redirect any subscriber-level users back to the site home page if they try to access anything within /wp-admin - but not if they try to go to /wp-login.php :

// REDIRECT ALL 'SUBSCRIBER' USERS TO SITE HOME PAGE IF THEY TRY TO ACCESS WP-ADMIN
add_action( 'init', 'blockusers_init' );
function blockusers_init() {
    if ( !current_user_can( 'edit' ) && is_admin() ) {
        wp_redirect( home_url() );
        exit;
    }
}

I tried using the role instead of capability ('subscriber' instead of 'edit'), and that worked when I was on a single-site installation of WordPress - but this theme is now being used in a multisite/subfolder installation and for some reason the role doesn't work. Using the code above, anytime a subscriber goes to either /wp-admin or /wp-login.php they get redirected to the home page.

Any ideas? Thanks for your help!

share|improve this question
    
I added this my functions file in a vanilla WP install, and it doesn't redirect me when I hit wp-login. Have you tried disabling all plugins? Also, "edit" isn't a capability, unless it's custom to your install: codex.wordpress.org/Roles_and_Capabilities –  MathSmath May 10 '12 at 23:52
    
thank you! I must be going blind. Sadly it still doesn't work in multisite, but at least that's one potential issue eliminated. I did try disabling all plugins and that didn't have any effect. –  Michelle May 11 '12 at 15:50
    
My bad--I didn't try it on a multisite install. –  MathSmath May 14 '12 at 16:26
add comment

1 Answer

So, first off, if you want to block access to wp-admin, why hook into something that fires on every page load? Hook into admin_init instead.

And, as @MattSmath mentioned, edit isn't a capability. edit_posts is. Also, admin_init only fires on admin pages, so you can remove is_admin() from your check.

Your revised function:

<?php
add_action('admin_init', 'wpse51831_init');
function wpse51831_init()
{
    if(!current_user_can('edit_posts')) 
    {
        wp_redirect(home_url());
        exit();
    }
}

Bonus: You're probably not going to want to show your subscriber level users the WordPress admin bar (which links them back to wp-admin). This will hide it:

<?php
add_filter('show_admin_bar', 'wpse51831_hide_admin_bar');
/*
 * hide the admin bar for `subscribers`
 *
 * @uses current_user_can
 * @return boolean
 */
function wpse51831_hide_admin_bar($bool)
{
    if(!current_user_can('edit_posts'))
    {
        $bool = false;
    }
    return $bool;
}
share|improve this answer
    
The "admin" bar is not an admin bar in 3.4, it's a generic toolbar that, in many cases, is integrated into the theme. +1 for the code to fix the admin, -1 for hiding a somewhat essential core feature. –  EAMann May 11 '12 at 4:30
    
Thank you for both these! Man do I feel dumb for not seeing the edit_posts thing. Unfortunately though even with the new code, it's still not working. /wp-admin redirects correctly, but wp-login.php also redirects. Maybe it's a multisite thing? Because it does work on a single-install of WP with the same plugins enabled. –  Michelle May 11 '12 at 15:47
2  
Also thanks for the hiding admin bar filter, I actually already had that working. @EAMann, in my case I am using the login system only to show/hide certain content, and I really don't want any subscribers to see any part of the dashboard or WP functionality. So hiding the bar seems appropriate. –  Michelle May 11 '12 at 15:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.