1

So typically, most plugins require the manage_options capability to access their options pages.

Some plugins offer a hook that allows you to assign a custom capability that will grant a user access to their options page, but many do not.

Is there anyway to check which plugins option page is trying to be accessed (and by what user), and then add the manage_options capability if the user should have access to that particular options page?

I have searched quite a bit and not found an answer for this yet... if this is not possible at all, then that would be an acceptable answer, so I do not continue trying to do something that can not be done. I was trying to use the user_has_cap filter, but this only returns the users capabilities and does not tell me what they are trying to access.

1 Answer 1

1
+50

It is quite complex to limit the 'manage_options' capability to certain users for specific plugins when the plugins do not provide a way to assign custom capabilities.

So it's best to reach out to the plugin developers and ask if there is a hook or filter to change the capability required to access the plugin options. This would be a more secure solution.

If for some reason they won't be able to provide you with hook or filter, what you can do is to create a custom function using 'admin_init' hook which will check the current page and user, and if they meet your specific criteria, grant them the 'manage_options' capability temporarily.

For example:

function my_custom_capabilities() {
    // Get current user
    $current_user = wp_get_current_user();
    
    // Get current page
    global $pagenow;

    // Check if we're on a specific plugin's options page and if the user is the one specified
    if ($pagenow == 'options-general.php' && isset($_GET['page']) && $_GET['page'] == 'your-plugin-slug' && $current_user->ID == 'your-user-ID') {
        // Temporarily add the 'manage_options' capability to the user
        $current_user->add_cap('manage_options');
    } else {
        // If we're not on the specific plugin's page or if the user is not the one specified, remove the 'manage_options' capability
        $current_user->remove_cap('manage_options');
    }
}
add_action('admin_init', 'my_custom_capabilities');

Replace your-plugin-slug with the slug of the options page of the plugin you want to give access to, and your-user-ID with the ID of the user you want to give the manage_options capability.

This script adds the manage_options capability to the specified user only when they are on the options page of the specified plugin. Once they navigate away from that page, the capability is removed.

Be careful, this method has a potential security risk, as the user will technically have manage_options capability while on that page, so they could potentially use it to access other settings. Please use it carefully and consider all potential implications before implementing it.

2
  • Playing around with this, I think I will be able to get it to work for my needs. However, when the page is options-general.php then $pagenow actually returns admin-ajax.php and not options-general.php.
    – jsherk
    May 24, 2023 at 2:04
  • Correction ... the admin-ajax might be coming from another page I was working on! But either way, the options-general.php does not seem to trigger the $pagenow or the $current_user. I tried on edit.php page with $_GET['post_type'] and it works
    – jsherk
    May 24, 2023 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.