0

I have installed a plugin (https://de.wordpress.org/plugins/food-and-drink-menu/) for which I want to assign permissions to a normal "editor" user.

I found the plugin "User Role Editor" but there is no specific "permission-name" or "capability" for that specific plugin which I can simply assign (or remove) for specific user roles. So I'm wondering how to find out from the plugins source code which roles would be needed to fully access the plugin? Is there such a way?

I mean, in general, if a plugin uses e.g. custom post types, i.e. writes to the posts-table in SQL - is it at all possible, e.g. to give permission to the specific plugin but deny permission for "normal" posts in Wordpress? How is such a separation done?

Or is it possible to somehow tell Wordpress from "externally" (i.e. by custom function) that a specific user role may access the plugin with all its sub-menus / settings etc?

Thanks so much in advance


My current idea, based on the comments below, is: The plugin dashboard, settings etc are always called from the Admin Menu using a specific GET Parameter, e.g. so: /wp-admin/edit.php?post_type=fdm-menu&....

So I could go like this: Temporary capability for current_user_can()

And hook into "user_has_cap", whenever $_GET['post_type'] equals to "fdm-menu", just assign admin permissions. I know it's not super clean because in theory, the user could call EVERY admin URL / setting and just add the parameter to the URL, but it should suffice for many cases where I just want to avoid that the website owner destroys my setup page, but should simply be restricted to specific pages / posts etc...

4
  • Most plugins use the current_user_can('manage_options') OR current_user_can('administrator'), I would start with those. If you are lucky, the plugin would have a filter you can hook into and extend the permissions May 10 at 9:32
  • It depends entirely on the plugin, you will need to speak to its author, but if the plugin uses a custom post type and no custom permissions appear in User Role Editor then chances are the custom post type is just configured to use the same capabilities as regular Posts. May 10 at 9:36
  • @Buttered_Toast Thanks, so that means the plugin uses the function current_user_can to see if a user has permissions? So you mean I should hook into user_has_cap and return True in case the capabilities for a specific context (i.e. the plugins name) are requested?
    – tim
    May 10 at 10:29
  • @JacobPeattie: So then there'd be only the way mentioned by ButteredToast to hook into the user_has_cap function/filter? Because Id like to give a user permission to a specific plugin but NOT to the rest of the Admin dashboard (like e.g. posts, pages etc).
    – tim
    May 10 at 10:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.