3

On a multisite installation I have created some custom roles. Some of them have the capabilities to create new users.

I want to allow users to create new users only with allowed roles.

One step is to use the editable_roles filter to remove roles from the dropdown but this doesn't prevent the user from modifying the select value and create a user with "not allowed" role.

2
  • Do you use the free or pro version? Can I suggest contacting the plugin owner? I had a problem with his plugin (pro version) and couldn't achieved something similar. He answered fast and solved my problem.
    – ltp
    Feb 5, 2018 at 19:56
  • I also tried without the plugin and didn't work. Feb 6, 2018 at 6:36

1 Answer 1

4

One step is to use the editable_roles filter to remove roles from the dropdown but this doesn't prevent the user from modifying the select value and create a user with "not allowed" role.

Yes it does. This filter is not just for the dropdown. Modifying editable_roles does in fact prevent users from assigning a role they're not allowed to.

This is because edit_user() (the function used for adding new users) calls get_editable_roles() as well and bails when one is not allowed to give users that role.

Here's a simple example of what you can do:

/**
 * Removes Administrator from roles list if user isn't an admin themselves.
 *
 * This way, only admins can make new admins.
 *
 * @param array $all_roles List of roles.
 * @return array Modified list of roles.
 */
function wpse_293133_filter_editable_roles( $all_roles ) {
  if ( ! is_super_admin( get_current_user_id() ) ) {
    unset( $all_roles['administrator'] );
  }

  return $all_roles;
}

add_filter( 'editable_roles', 'wpse_293133_filter_editable_roles' );
2
  • @swisspidy thank you for your answer but I already tried that and it worked as I described. I took another test on a clean WP installation. I created two roles with the same capabilities using the User Role Editor plugin. I removed the "roleb" using editable_roles. The "roleb" doesn't appear in the dropdown but I changed the value of another role in the DOM using the inspector to "roleb". User successfully created with "roleb". Feb 5, 2018 at 7:24
  • I can confirm that is working on single installations but not on Multisite. Feb 6, 2018 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.