Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

In order to allow editors to edit other's author meta (update_user_attribute), I must give them the 'manage_options' capability or else I get a 'Cheatin' huh' die message. I only want to give them this capability on one specific Edit Author Meta page.

I give 'editor' permission to 'list_users' to access the Users admin table. I give 'editor' permission to 'manage_options' upon entering the specific author meta page. (I tried placing at the top of function save_profile_fields but still got the die message.)

I remove the 'manage_options' capability at the bottom of the save_profile_fields function. This works, but if the editor neglects to save anything on the author meta page, the editor keeps the 'manage_options' capability.

if( !current_user_can( 'manage_options' ) && current_user_can( 'edit_others_posts' ) ){
    $edit_editor_role = get_role( 'editor' );
    $edit_editor_role->add_cap( 'manage_options' );
}

Where would one remove the capability 'manage_options' from the editor role?

$edit_editor_role = get_role( 'editor' );
$edit_editor_role->remove_cap( 'manage_options' );
share|improve this question
add comment

1 Answer 1

Good question! The capability checking is probably done quite early in the loading process. By looking at /wp-admin/users.php you can tell that one of the first things to happen is current_user_can( 'list_users' ), so that one is clearly needed or you'll get the "Cheatin' uh?" warning. But right before that, /wp-admin/admin.php is included, and at the bottom of that file WordPress will call an individual action for each page, load-users.php when loading wp-admin/users.php.

This means you should be able to setup a function to add the capabilities needed to perform your tasks during loading of that page (given that the current user has sufficient permissions to begin with, naturally). Something like this might work when giving a user new capabilities on the users list and user edit pages:

function my_add_caps() {
    // add capabilities here
}
add_action('load-users.php', 'my_add_caps');
add_action('load-profile.php', 'my_add_caps'); // might be needed if you somehow cannot edit your own user
add_action('load-user-edit.php', 'my_add_caps');

I wouldn't worry too much about removing the capabilities though, once the page is loaded the added capability will have played out its part. Keep in mind though that you might have to add the capability for admin pages responsible for storing options, or any AJAX-request handlers, depending on how much capability checking is done by WordPress during validation/storing of options.

share|improve this answer
    
the capability is added on the page load, but unfortunately it stays there afterwards. –  AlxVallejo Jan 30 '13 at 19:53
    
Oh, I must have misunderstood your question, sorry about that. Perhaps a workaround could be to use the Transients API regularly reset permissions, or perhaps update_user_meta to store info about which users have been granted extend permissions, and simply clear it on init unless its needed for the currently loading page? –  Simon Jan 30 '13 at 20:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.