Remove menu items from admin page and limit capabilities

Question

By default, I am allowing people to subscribe as contributors to my site which allows them certain actions.

What I then want to do is remove Posts, Comments, Contact (ContactForm7) and Tools leaving them only options to add new Events (events plugin).

I also want to be sure that even though these buttons are hidden, people cannot submit to these PostTypes if they knew how to.

I am reading through the Professional WordPress plugins development book at the moment and it's a lot to take in so I'd like to do this just in my theme's functions page for now.

Here's what I am trying according to the codex:

    add_action( 'admin_menu', 'jh_remove_menu_pages' );
    function jh_remove_menu_pages() {
        remove_menu_page('edit-comments.php');  
        remove_menu_page('tools.php');  
        remove_menu_page('edit.php');   
        remove_menu_page('wp-contact-form-7.php');  
    }

I've managed to do a find on this page to fins all the php files I need to hide but I am not sure about the ContactForm7 file. EDIT: Managed to find solution here to remove Contact Form 7 from Admin Menu

According to the codex though, the code above does not remove the permissions for them to access the screens (posts, tools etc) directly and still submit if they knew how: "Please be aware that this would not prevent a user from accessing these screens directly. Removing a menu does not replace the need to filter a user's permissions as appropriate."

How would I remove the capabilities of all the above except the for Events and Profile? I'm reading through remove_cap in the codex, but I am concerned that I might inadvertently switch off posting Events if I remove the Posts capability?

And lastly, how do I show only the related Events for the user who is logged in at the time?

Many thanks.

Answer 1

In your case best solution is create your own custm role and assign them only the capabilities you users need. Regarding wordpress, for what I can understand from your question the only cabability you should give them is read.

In this way they will see only the profile. Problems start with the plugin, you don't say (or I don't understand) which is the plugin you are using so I can't give better help.

Consider that a lot depends on how plugin is coded: if it checks for some standard capabilities, e.g. you find in the code something like

if ( currrent_user_can('edit_posts') ) { // do stuff

it means that to make it work you have to assign the edit_posts cap to your role. But this is a problem: if you assign that capability the Postmenu in admin will be shown. Of course you can remove that using remove_menu_page, but as you said in question, this not prevent user access directly to that admin screens if they know how to do.

So what I suggest to you is:

1. Create your custom role, start with assign to that only the read cap
2. See docs for your plugin and/or look at the code to understand wich capabilities is required to make it works.
3. Add these required capabilities to your role. If some standard caps are required, (and so some standard menu will be shown, remove them with remove_menu_page
4. In that case, to prevent direct access, thanks to the fact you have created a custom role, you can prevent the access to admin screen hooking into load-{$page} action and prevent access to your custom role.
5. In backend, got to Settings -> General and make 'Custom Role' as New User Default Role

How To

1) Create Role

$subscriber = get_role( 'subscriber');
$plugin_caps = array('edit_posts', 'cap_required_by_event_plugin');
$all_caps = array_merge($subscriber->capabilities, $plugin_caps);
add_role('custom_role', 'Custom Role', $all_caps );

2) Understand the capability required by plugin

Look at plugin docs. Do a multiple file search into the plugins folder, searching for keywords like 'current_user_can', 'user_can', 'has_cap'. If you have problem try to ask on plugin support forum (if exists), ask here and google it. Developer is and hard work! ;)

3) Add required capabilities to your role

Easiest way is just add the required cap to the $plugin_caps array defined on point 1).

4) Prevent access to screen even if the capability is attached to custom role

Assuming you have to add the edit_posts cap to your role in order to make event plugin works. First of all remove the menu.

add_action( 'admin_menu', 'custom_remove_menu_pages' );

function custom_remove_menu_pages() {
  $user = wp_get_current_user();
  if ( in_array('custom_role', $user->roles) ) {
    remove_menu_page('edit-comments.php');  
    remove_menu_page('tools.php');  
    remove_menu_page('edit.php'); 
  }
}

Then prevent access:

add_action( 'load-edit.php', 'custom_prevent_admin_access' );
add_action( 'load-tools.php', 'custom_prevent_admin_access' );
add_action( 'load-post.php', 'custom_prevent_admin_access' );
add_action( 'load-post-new.php', 'custom_prevent_admin_access' );

function custom_prevent_admin_access() {
  $user = wp_get_current_user();
  if ( in_array('custom_role', $user->roles) ) {
    wp_die("Sorry, you can't stay here.");
    exit();
  }
}

5) Set 'Custom Role' as New User Default Role

---

That's all, hope it helps.