Restrict access in wp-admin area?

Question

What action or filter do I have to check or compare against $pagenow?

In the admin area, I need to let non admin and editor users only to access:

index.php (dashboard)
upload.php (attachments management)
media.php (attachments management)
media-new.php (attachments management)

Thanks in advance.

Answer 1

that depends on if you want to redirect users away the you should use init hook since no output or headers are sent before that hook. or if you want to display a nice "You Don't have the right permissions to access this page" message then you can use the wp_head action hook:

//display meassage
add_action('admin_head','my_restrict_access');
function my_restrict_access_meassage(){
    global $pagenow;
    if ($pagenow == 'upload.php' && !current_user_can( 'upload_files' )){
        echo '<div class="wrap"><br />
            <div id="message" class="error">You Dont have the right permissions to access this page</div>
        </div>';
        exit();
    }
}
//or redirect
add_action('init','my_restrict_redirect');
function my_restrict_redirect(){
    global $pagenow;
    if (!is_admin())
        return '';
    if ($pagenow == 'upload.php' && !current_user_can( 'upload_files' )){
        wp_redirect( home_url() );
        die();
    }
}

Answer 2

I propose Members plugin. It allows you to create new user groups and define their access to each and almost every page in wp-admin. You can find it here: http://wordpress.org/extend/plugins/members/