Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
    update_core
    update_plugins
    update_themes
    install_plugins
    install_themes
    delete_themes
    edit_plugins
    edit_themes

Hi, I want to restrict those capabilities to user_id = 1 so other super admins cant edit network files. (Btw if i am missing something, let me know). What is proper way of this? Tried http://wordpress.org/extend/plugins/extended-super-admins/ but it adds 'manage_esa_options' cap to every blog so super_admins see tons of blogs in their admin bar..

share|improve this question
    
If you don't want super admins to be able to edit the network, why not just make the admins? –  user1337 Jun 19 '12 at 19:14
    
Need a super admin that can add/remove sites/users.. but he mustn't reach site files.. –  Ünsal Korkmaz Jun 20 '12 at 7:36
add comment

1 Answer

up vote 4 down vote accepted
+50

Editing super admin capabilities is a little different from editing the capabilities of every other role, because there is a slight detour in the way WP checks the current user's capabilities. This is what you find on capabilities.php on line 864:

function has_cap( $cap ) {

    // (...)

    // Multisite super admin has all caps by definition, Unless specifically denied.
    if ( is_multisite() && is_super_admin( $this->ID ) ) {
        if ( in_array('do_not_allow', $caps) )
            return false;
        return true;
    }

This means that we have to explicitly add 'do_not_allow' to the an array which contains the capability we want to block. In effect:

add_filter('map_meta_cap', 'not_so_super_admins', 10, 4);
function not_so_super_admins($caps, $cap, $user_id, $args){

    $super = array(
        'update_core',
        'update_plugins',
        'update_themes',
        'install_plugins',
        'install_themes',
        'delete_themes',
        'edit_plugins',
        'edit_themes'
    );

    if($user_id != 1 && in_array($cap, $super)) {
        $caps[] = 'do_not_allow';
    }

    return $caps;
}

I've tested this and it seems to block additional super-admins from doing those things you want to prevent, and it does so fairly silently (i.e. redirects them to the network dashboard).

For the record, my previous answer, would work for most cases except the one you were asking for. My apologies :)

add_action('init', 'not_so_super_admins');
function not_so_super_admins() {
    if(is_multisite() && $GLOBALS['blog_id'] == 1) {
        $role = get_role('administrator');
        $super = array(
           'update_core',
           'update_plugins',
           'update_themes',
           'install_plugins',
           'install_themes',
           'delete_themes',
           'edit_plugins',
           'edit_themes'
        );          
        if(get_current_user_id() != 1) {   
            foreach($super as $cap) {
                $role->remove_cap($cap);
            }
        }
        else {
            foreach($super as $cap) {
                $role->add_cap($cap);
            }           
        }
    }
}
share|improve this answer
    
Nope.. Just tried. They can still install plugins –  Ünsal Korkmaz Jun 21 '12 at 21:19
    
You're right, I'm sorry. I gave it one more try and it now seems to be a more appropriate answer for your needs. Can you let me know (again) if it works? –  tbuteler Jun 22 '12 at 15:07
    
didnt tried all, just tried "install_themes" and its working now.. thanks a lot :) –  Ünsal Korkmaz Jun 22 '12 at 19:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.