Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I allow the author user role to add/edit posts (using a custom post type called "User Posts") as well as add/edit their own media from wp-admin. I currently have it set up so that the only menu items they see are the "User Posts" "New User Post" "Media" and "Upload Media", with these URLs: post-new.php?post_type=tsv_userpost edit.php?post_type=tsv_userpost upload.php media-new.php

The only problem is that if the user types in the URL of, for instance, post-new.php (without the custom post type part) Wordpress still allows them to see that page. No bueno.

Is there a way to redirect or display an error message to users if they are not admins and if they land on any wp-admin page EXCEPT the above URLs?

I have tried using this code (just for the post-new.php page) from another thread, but it doesn't seem to do anything:

//Show error message if authors try to access wrong wp-admin pages
add_action('admin_head','my_restrict_access');
function my_restrict_access_meassage(){
    global $pagenow;
    if ($pagenow == 'post-new.php' && !current_user_can( 'switch_themes' )){
        echo '<div class="wrap"><br />
            <div id="message" class="error">You Dont have the right permissions to access this page</div>
        </div>';
        exit();
    }
}

Thanks is advance.

EDIT: Here's the code I ended up with that works:

        //Restrict access to authors in wp-admin pages
    //Show error message if authors try to access wrong wp-admin pages
    add_action('admin_head','my_restrict_access');
    function my_restrict_access(){
        $Path=$_SERVER['REQUEST_URI'];
        $basepath='http://www.theseattlevine.com/wordpress/wp-admin';
        $URI='http://www.theseattlevine.com'.$Path;

            if      (   ($URI ==($basepath . '/post-new.php')) && !current_user_can ('manage_categories') ) {
                        echo    '<div class="wrap"><br />
                                    <div id="message" class="error">You Dont have the right permissions to access this page. Try these links instead: 
                                        <ul>
                                            <li><a href="/">The Vine Homepage</a></li>
                                            <li><a href="/wordpress/wp-admin/post-new.php?post_type=tsv_userpost">Add a new user post</a></li>
                                            <li><a href="/dashboard">Your dashboard</a></li>
                                        </ul>
                                    </div>
                                </div>';
                        exit();
                        }
            elseif      (   ($URI ==($basepath . '/edit.php')) && !current_user_can ('manage_categories') ) {
                        echo    '<div class="wrap"><br />
                                    <div id="message" class="error">You Dont have the right permissions to access this page. Try these links instead: 
                                        <ul>
                                            <li><a href="/">The Vine Homepage</a></li>
                                            <li><a href="/wordpress/wp-admin/post-new.php?post_type=tsv_userpost">Add a new user post</a></li>
                                            <li><a href="/dashboard">Your dashboard</a></li>
                                        </ul>
                                    </div>
                                </div>';
                        exit();
                        }

    }
share|improve this question
    
Oh, and I'm not looking for a plugin solution. Just a function of some sort. Thanks. –  Eckstein Dec 30 '12 at 23:30
1  
make sure that the second parameter in the "add_action" function matches the name of your restrict access function. It should look something like this: add_action('admin_head','my_restrict_access'); function my_restrict_access(){ /* code as before */ } –  guiniveretoo Dec 31 '12 at 19:54
    
Oh duh! I was so busy focusing on the functionality I forgot basic things like checking the name of the function.... Anyway, I updated my questions with the code I used to restrict the two pages I was having issue with in case it's useful to anyone. If you want to add an answer, I can select you as the winner. Up to you. Thanks! –  Eckstein Jan 1 '13 at 1:43
    
Post your solution as an answer. –  toscho Jan 1 '13 at 16:59
add comment

1 Answer

up vote 1 down vote accepted

Make sure that the second parameter in the "add_action" function matches the name of your restrict access function. It should look something like this:

add_action('admin_head','my_restrict_access'); 
function my_restrict_access(){ /* code as before */ } 

Glad I could help. :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.