How to give remove role editing permission from user

Question

I am trying to give a permission to user with role editor to create, edit and delete users, but would like to limit that so that they can not edit their roles. I have edited the capabilities of the user with the role editor like this:

function add_theme_caps() {
    $role = get_role( 'editor' );
        $role->add_cap( 'delete_users' );
        $role->add_cap( 'create_users' );
        $role->add_cap( 'add_users' );
        $role->add_cap( 'list_users' );
}
add_action( 'admin_init', 'add_theme_caps');

But, I am not sure how can I remove the roles button when they are editing users?

Answer 1

This will remove the option to change user group except if this is the administrator.

The Codex states:

While checking against particular roles in place of a capability is supported in part, this practice is discouraged as it may produce unreliable results.

For this reason, I check for activate_plugins capability that normally only Admins will have.

function dont_allow_role_change($all_roles) {
    global $user_id;
    $user_meta = get_userdata($user_id);

    if(!current_user_can('activate_plugins') && is_int($user_id)){
        foreach ( $all_roles as $name => $role ) {
            if (!in_array($name,$user_meta->roles)) {
                unset($all_roles[$name]);
            }
        }
    }
    return $all_roles;
}

add_filter('editable_roles', 'dont_allow_role_change');