Restrict Author to pick from media library, but not upload media

Question

I have a multisite network where the super admins will be creating the individual sites. An important role we need to enable, for compliance reasons, is to restrict "Authors" to not be able to upload media, but be able to access the media library to choose from media that is uploaded by the super admin. I have downloaded the User Role Editor plugin, which is a great plugin btw, but the only option it gives is to turn off the "upload_files" function. That takes away all ability to access the media library. No bueno.

Anyone wanna take a stab at this??

Answer 1

Just taking a rough stab at this...

add_filter('media_upload_tabs', 'modify_media_tabs');
function modify_media_tabs($tabs) {
    if (is_super_admin()) return $tabs;
    return array(
        'type_url' => __('From URL'),
        'gallery' => __('Gallery'),
        'library' => __('Media Library')
    );
}

add_filter('_upload_iframe_src', 'change_default_media_tab');
function change_default_media_tab($uri) {
    if (is_super_admin()) return $uri;
    return $uri.'&tab=library';
}

add_action('current_screen', 'check_uploading_permissions');
function check_uploading_permissions() {
    if (is_super_admin()) return;
    if (get_current_screen()->id == 'media-upload' || (get_current_screen()->action == 'add' && get_current_screen()->id == 'media')) {
        $post_id = (int) $_GET['post_id'];
        if (!$post_id || isset($_GET['inline']))
            wp_die(__('You do not have permission to upload files.'));
        if ( !isset($_GET['tab']) || !($_GET['tab'] == 'library' || $_GET['tab'] == 'type_url' || $_GET['tab'] == 'gallery')) {
            wp_redirect( admin_url('media-upload.php?tab=library&post_id='.$post_id) );
            exit;
        }
    }
}

We're doing 3 things:

1. Removing the "My computer" tab from the editor's popup uploader
2. We're making the default tab "Library" in the editor's popup uploader
3. We're denying permission to direct access to the media upload pages

I did this for anyone who isn't a super admin, but of course, you can add in a clause for other capabilities instead. I didn't try POSTing an image to see if it's bypass-able, so if compliance is your game, you'd want to do that. In fact, while it may go without saying, I'll say it anyway:

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

Hope this helps!

Cheers~