In admin manage users page, how can I stop users with certain privileges from editing users with other privileges?

Question

I've got two custom roles in my application: super_administrator and liaison. In the context of the manage users page, super admins can do anything, but liaisons are read only. Super admins can see all users registered in the application, but liaisons can only see users in the same college as them (handled through a meta key).

When a liaison is logged in and goes to the users page, I want them to be able to see all users at their college (this is already working), but not edit them.

I did some trickery with the user_row_actions filter to remove the edit (and delete) button, and I removed the bulk actions container whenever they're logged in as a liaison.

However, they can still click the name of a user and go to the page there and edit. Is there any way I can prevent this?

Answer 1

It sounds like you want to remove the following permissions from the 'liaison' role:

• create_users
• delete_users
• edit_users
• promote_users
• remove_users

Keep "list_users" so they can see the list, but not edit anything.

The easiest way to remove these permissions is to use a Role Editor plugin. Several are available; you'll select the 'liaison' role, and then through a series of checkboxes, you can remove the above permissions. Once you've saved, you can remove the plugin; WP will keep the permissions as you've saved them.

If you'd rather not use a third-party plugin, you can use code like this instead:

// Temporarily remove Liaison
remove_role('liaison');
// Add Liaison role back, with only the permissions you specify here
add_role('liaison', 'Liaison');
$liaison = get_role('liaison');
$liaison->add_cap('read');
$liaison->add_cap('list_users');

You may find Liaisons need a couple of other permissions, but this will give them read-only access to content as well as a list of users.