0

I've got two custom roles in my application: super_administrator and liaison. In the context of the manage users page, super admins can do anything, but liaisons are read only. Super admins can see all users registered in the application, but liaisons can only see users in the same college as them (handled through a meta key).

When a liaison is logged in and goes to the users page, I want them to be able to see all users at their college (this is already working), but not edit them.

I did some trickery with the user_row_actions filter to remove the edit (and delete) button, and I removed the bulk actions container whenever they're logged in as a liaison.

However, they can still click the name of a user and go to the page there and edit. Is there any way I can prevent this?

  • 1
    You may encounter some confusion naming a role super administrator, as super admin is already a term used in WordPress multisites. People will assume you mean a multisite super admin, not a custom role named super admin. The same is true of Network Admin, the admin area for multisite installs – Tom J Nowell Jun 29 '17 at 15:45
0

It sounds like you want to remove the following permissions from the 'liaison' role:

  • create_users
  • delete_users
  • edit_users
  • promote_users
  • remove_users

Keep "list_users" so they can see the list, but not edit anything.

The easiest way to remove these permissions is to use a Role Editor plugin. Several are available; you'll select the 'liaison' role, and then through a series of checkboxes, you can remove the above permissions. Once you've saved, you can remove the plugin; WP will keep the permissions as you've saved them.

If you'd rather not use a third-party plugin, you can use code like this instead:

// Temporarily remove Liaison
remove_role('liaison');
// Add Liaison role back, with only the permissions you specify here
add_role('liaison', 'Liaison');
$liaison = get_role('liaison');
$liaison->add_cap('read');
$liaison->add_cap('list_users');

You may find Liaisons need a couple of other permissions, but this will give them read-only access to content as well as a list of users.

  • Oh, crud, I forgot an important piece in the process of oversimplifying. There actually is a third role, liaison_assistant, which can be created and managed by liaisons. I forgot to mention them because I forgot it would be important – Alex Kibler Jun 29 '17 at 15:46
  • I don't think there's a clean way to allow liaisons to create/edit/delete some roles, but not others. You'd probably have to rely on JS, which can be easily circumvented. So you may need to have the higher-level users manage the liaison_assistants instead. – WebElaine Jun 29 '17 at 15:57
  • Hmm, that's not really an option with the client's requirements. Is there a way to just not show any super admins or other liaisons when a liaison is viewing the user list? – Alex Kibler Jun 29 '17 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.