Disable media library tab for non admins in uploader screen

Question

I am developing a plugin in which i am required to allow front end users to upload media, which I am able to do. But I don't want to let them sneak into media library which comes as tab with uploader screen.

I tried the following

function remove_medialibrary_tab($tabs) {
    if ( !current_user_can( 'administrator' ) ) {
        unset($tabs['library']);
        return $tabs;
    }
    else
    {
        return $tabs;
    }
}
add_filter('media_upload_tabs','remove_medialibrary_tab');

But seems this filter is deprecated and doesn't works anymore.

Answer 1

This function will not show media library tab in upload screen

   function remove_medialibrary_tab($strings) {
        if ( !current_user_can( 'administrator' ) ) {
            unset($strings["mediaLibraryTitle"]);
        return $strings;
        }
        else
        {
            return $strings;
        }
    }
    add_filter('media_view_strings','remove_medialibrary_tab');

I found out that switching to media library tab actually call this ajax action query-attachments. So i added another callback function to this action with top priority, which checks if user is not admin , the action halts right there. This did the trick for me :)

function restrict_non_Admins(){

        if(!current_user_can('administrator')){
            exit;
        }
    }

add_action('wp_ajax_query-attachments','restrict_non_Admins',1);
add_action('wp_ajax_nopriv_query-attachments','restrict_non_Admins',1);

Answer 2

The function media_upload_tabs() is not deprecated. It is called only by the_media_upload_tabs() (perfect naming, I know), which as well is only called once by media_upload_header()...

Edit - Just tested the filter with a plugin and while it's working and a var_dump( $tabs ) in an attached callback spits out the tabs, it doesn't do anything. The reason seems to be that all this now is generated by backbone and underscore templates with JavaScript. The file responsible for all the templates is ~/wp-includes/media-template.php. From a search through that, there's no filter to alter the output. Basically it's just one massive PHP function named wp_print_media_templates() that wraps all the templates and that has some actions before and after different templates.

I just tried to console.log() the wp object and found wp.media.view which seems to hold ... something. ~/wp-includes/js/media-modals.js seems to be the root of all that JavaScript generated UI. Now when I dig deeper, I find wp.template that gets "underscore-extended" into wp.media.template. Then I found the reference to ~/wp-includes/js/wp-util.js which then explains, that the argument for that JS function is an #id that is prefixed by tmpl-.

Now that only is a wrapper for _.memoize() which adds a custom callback "saves" computed results to "speed things up"... a bit. The contents are just a bunch of Regex-es that then get pushed to a function named compiled(), which just is (again) a wrapper for

_.template( $( '#tmpl-' + id ).html(), null, options )

.. ok. There's as well stuff from ~/wp-includes/js/media-views.js and ~/wp-includes/js/media-models.js involved and as I know close to nothing about Backbone anymore, I got no clue how to proceed from there. I'll leave my debugging plugin for this answer as well as the answer as starting point for others here.

<?php
defined( 'ABSPATH' ) or exit;
/**
 * Plugin Name: (#125669) Media Upload Tabs by role
 * Description: Removes media upload tabs on a by-role base.
 */

add_action( 'admin_footer', 'wpse125669MediaUploadTabsRemove', 0 );
function wpse125669MediaUploadTabsRemove()
{
    if ( "edit.php" !== get_current_screen()->parent_file )
        return;

    ?>
<script type="text/javascript">
console.log( wp.media );
</script>
    <?php
}

Answer 3

function restrict_media_library() {
    if( !current_user_can('manage_options') ) {
        wp_die( __('You are not allowed to access this page.') );
    }
}
add_action('admin_init', 'restrict_media_library');

function restrict_frontend_upload() {
    if( !current_user_can('manage_options') ) {
        remove_action( 'media_buttons', 'media_buttons' );
    }
}
add_action('init', 'restrict_frontend_upload');

This code uses the current_user_can function to check if the current user has the 'manage_options' capability, which is typically only assigned to administrators. If the user is not an administrator, the wp_die function is used to stop execution of the page and display a message indicating that the user is not allowed to access the page. The second function uses the remove_action function to remove the media_buttons action, which is responsible for displaying the media button in the editor, if the current user is not an administrator.