1

I have restricted a users capabilities

$capabilities = array(
    'delete_posts'           => true,
    'delete_published_posts' => true,
    'edit_posts'             => true,
    'edit_published_posts'   => true,
    'publish_posts'          => true,
    'read'                   => true,
    'upload_files'           => true
);

Everything works as I expect, except that the user cannot insert images into the editor field in a CPT, despite the fact they have the upload files capability.

'supports'      => array( 'title', 'editor' ),

What capability have I missed that lets them do this?

EDIT

So the offending code is somewhere below

function remove_admin_menu_items() {
    if ( current_user_can( 'test_author' ) ) {
        /** remove side dashboard items */
        remove_menu_page( 'edit.php' );                             //Posts
        remove_menu_page( 'edit.php?post_type=page' );              //Pages
        remove_menu_page( 'edit-comments.php' );                    //Comments
        remove_menu_page( 'themes.php' );                           //Appearance
        remove_menu_page( 'plugins.php' );                          //Plugins
        remove_menu_page( 'users.php' );                            //Users
        remove_menu_page( 'tools.php' );                            //Tools
        remove_menu_page( 'options-general.php' );                  //Settings
        remove_menu_page( 'edit.php?post_type=cpt_customposttype' );
    }
}
add_action( 'admin_init', 'remove_admin_menu_items' ); //use late hook so plugins have all loaded
1

You haven't missed any capabilities. User should be able to insert images into the editor with these capabilities.

The only problem I can think of is that, you are trying to modify the capabilities of a role which won't work.

See this section

If you are defining a custom role, and adding capabilities to the role using add_role(), be aware that modifying the capabilities array and re-executing add_role() will not necessarily update the role with the new capabilities list. The add_role() function short-circuits if the role already exists in the database.

The workaround in this case is to precede your add_role() call with a remove_role() call that targets the role you are adding.

  • I did do this, but it seems to be something else I've done. Thanks anyway – myol Jun 26 '15 at 9:02
0

I found the issue. Somewhere online recommended to use a late hook so all the plugins loaded.

add_action( 'admin_init', 'remove_admin_menu_items' );

Obviously I used the wrong hook. Instead I used the codex recommendation

add_action( 'admin_menu', 'remove_admin_menu_items' );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.