0

I'm building a website with WordPress, but it will be managed by more than 20 persons. What I want is to revoke access to each one without using a plugin.

I added in functions.php some code for those people who are not "administrators", I used code like this: remove_menu_page("page X"), but the problem is if they put following url in the browser: wp-admin/edit.php?post_type=testimonial they still have access.

What should I do when a user is not the user I want. I want to use some code like this: if($current_user->ID != '21') ) he/she should be redirected to wp-admin/index.php.

My idea was trying to get the page ID or the current url but it is not working in the way I use the code.

I also need to mention that I installed a few plugins, and they add some extra menus like: edit.php?post_type=testimonial or edit.php?post_type=etheme_portfolio.

All the users will be administrator but only I should be able to see all menus and having access to everything (As a super admin?). So even another administrator should not have access to everything in the backend when he has not ID 1 (in this case that is me).

What I already did is removing following:

remove_menu_page('edit.php?post_type=testimonial');
remove_menu_page('edit.php?post_type=staticblocks');
remove_menu_page('edit-comments.php');
remove_menu_page('edit.php?post_type=etheme_portfolio');
remove_menu_page('edit.php?post_type=essential_grid');
remove_menu_page('themes.php');
remove_menu_page('plugins.php');
remove_menu_page('users.php');
remove_menu_page('tools.php');
remove_menu_page('options-general.php');
remove_menu_page('themepunch-google-fonts');
remove_menu_page('wpcf7');
remove_menu_page('ot-theme-options');
remove_menu_page('yith_wcwl_panel');
remove_menu_page('vc-general');
remove_menu_page('mailchimp-for-wp');
remove_menu_page('revslider');
remove_menu_page('yit_plugin_panel');
remove_menu_page('about-ultimate');
remove_menu_page('essential-grid');

I hope my question is clear but if you have any doubts please ask.

Thanks !

1
  • Welcome to wpse, I have edit your question a little (didn't want to make a complete overhaul) to make it more clear for other users to what you want to achieve. – Charles Feb 10 '16 at 5:02
3

You can do this several ways, it just depends on how specific you want to get. Like do you need to disable for only one user with the ID of 21 or was that just an example? And are you trying to disable several pages or just a couple?


Example 1: You can do this to redirect the dashboard to the edit posts page if not an administrator.

add_action('load-index.php', function(){
   if(!current_user_can('administrator')){
      if(get_current_screen()->base == 'dashboard')
         wp_redirect(admin_url('edit.php'));
   }
});

Example 2: Or for a lot of pages you could do something like this:

function bw_redirect_admin_pages() {
    if(!current_user_can('administrator')){
      global $pagenow;
      $admin_pages = array(
                                'options-writing.php',
                                'options-reading.php',
                                'options-discussion.php',
                                'options-media.php',
                                'options-privacy.php',
                                'options-permalink.php',
                        );
      if(in_array($pagenow, $admin_pages)){
        wp_redirect( admin_url('/') ); 
        exit;
      }
   }
}
add_action('admin_init', 'bw_redirect_admin_pages');

Sidenote : If you need to be more specific on users you can use wp_get_current_user()


Example 3: You can also change individual capabilities for other users.

Let's say your user ID is 1. Now you can use map_meta_cap and block certain capabilities from users who aren't you. So in this example below, your saying that if the user is not user 1 (or whatever your ID is) than they can't delete or edit users.

add_filter('map_meta_cap', 'prevent_user_edit', 10, 4 );
function prevent_user_edit( $required_caps, $cap, $user_id, $args ){
    $protected_user = 1; // ID of user not editable (this should be YOUR user id)
    if ( $user_id === $protected_user ) // Don't block caps if current user = protected user
        return $required_caps;
    $blocked_caps = array(
        'delete_users',
        'edit_users'
        );
    if ( in_array( $cap, $blocked_caps ) && $args[0] === $protected_user )
        $required_caps[] = 'do_not_allow';
    return $required_caps;
}

Each admin menu and submenu is associated with a specific capability for different roles. So in the above example we disallow all users beside yourself to access the users page and also disallow them to delete users.

See the Roles vs Capability table to decide what to block as well as the menus associated with those capabilities here.

This is much safer than just "redirecting a page". The example above is a good demonstration of this. If only redirecting people away from the "users" page on page load, they'd still have the delete_users capability which you don't want.

You could then combine this example with one of the redirect ones if you wanted them to also redirect.


Example 4: Or another way to do the same thing above but with your email instead of your ID:

add_filter( 'user_has_cap',
function( $caps, $cap, $args ) {
    $user_id = $args[1];
    $user = new WP_User( $user_id );
    $email = $user->user_email;
    if ( $email != get_option('admin_email') )
        $caps['delete_user'] = false;
        $caps['edit_user'] = false;
    return $caps;
}, 10, 3 );

Here are some of the more common capabilities you can block

Example 5: I highly suggest giving 20 people administration roles though. You'd be much safer creating a custom role:

add_action( 'after_switch_theme', 'create_new_user_role' );

function create_new_user_role() {

    $add_role = add_role( 'manager', __( 'Site Manager' ),
            array(
                'read' => true,
                'edit_posts' => true,
                'edit_pages' => true,
                'edit_others_posts' => true,
                'create_posts' => true,
                'manage_categories' => true,
                'publish_posts' => true
            ));
}

Example 6: Change Displayed Role name

If they absolutely must be have "administrator" role, you could do some trickery. I haven't actually tested this though.

function brw_change_administrator_role_name() {
    global $wp_roles;
    if ( ! isset( $wp_roles ) )
        $wp_roles = new WP_Roles();

    // Change administrator role name to developer
    $wp_roles->roles['administrator']['name'] = 'Developer';
    $wp_roles->role_names['administrator'] = 'Developer';  

    // Change editor role name to administrator
    $wp_roles->roles['administrator']['name'] = 'Administrator';
    $wp_roles->role_names['administrator'] = 'Administrator';  


}
add_action('init', 'brw_change_administrator_role_name');

Similarly, you could also try this (although again not tested):

add_filter(  'gettext',  'brw_translate_words_array'  );
add_filter(  'ngettext',  'brw_translate_words_array'  );
function brw_translate_words_array( $translated ) {

     $words = array(
                        'Administrator' => 'Developer',
                        'Editor' => 'Administrator'
                    );
     $translated = str_ireplace(  array_keys($words),  $words,  $translated );
     return $translated;
}
14
  • I just updated the description for if it will makes more sense for you, I'm doing echo's and it shows me the ID of the user on the backend but for no reason is not doing the redirects. I'm doing a var_dump and it shows edit.php no edit.php?post_type=essential_grid that's the one I want to revoke access. – ARweaber Feb 10 '16 at 3:52
  • @Bryan I edit his question a little to make it a bit more clear what he/she wants to achieve (although it still needs to be reviewed by peer :) ). If I understand it correctly he want to have one super admin and 20+ others will be having the administrator role with reduced capabilities. (and yes ID 21 is just an example if I am correct) – Charles Feb 10 '16 at 5:04
  • @Charles yes that's what I want :) – ARweaber Feb 10 '16 at 5:23
  • See my edit ARweaber, I think I understand what you want now. – Bryan Willis Feb 10 '16 at 6:29
  • Here's a bunch more examples I put together awhile back for doing these types of things. gist.github.com/bryanwillis/… – Bryan Willis Feb 10 '16 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.