0

In my multi-site WordPress, administrators and editors don't see the Additional CSS section in the customizer. I would like them to have access to that panel. Only super-admins can see the additional CSS panel currently.

I've tried adding the following capabilities to the editor role:

  • 'edit_css'
  • 'customize_css'
  • 'unfiltered_html'
  • 'switch_themes'
  • 'create_patterns'
  • 'update_themes'
  • 'edit_themes'

...none of which enabled the panel in the customizer. Really, edit_css should have worked based on wp-includes/class-wp-customize-manager.php:5740 (wordpress 6.2) where it seems to indicate that edit_css is the required capability to display the Additional CSS panel.

I've also tried switching to TwentyTwelve theme, but still nothing.

3
  • administrators are meant to be able to see it, you shouldn't need to be a super admin, are you sure there aren't other things messing with this? You should try to fix this for admins before getting it working for editors. How are you changing the capabilities of each role? I can't see any code for this in your question, are you using WP CLI? Editing the DB? Filters?
    – Tom J Nowell
    Aug 16, 2023 at 16:32
  • Thanks @TomJNowell. The code that changes the capabilities is a complicated plugin we wrote that we've been using for years with no problems. I simply added one more capability to this list. I've since tried this on another multisite instance that has no role modifications, and I get the same result -- site admins can't see the css panel.
    – JakeParis
    Aug 16, 2023 at 19:03
  • the issue is that capabilities aren't always as cleanly isolated from eachother, e.g. a capability check for a feature may never even fire because a pre-requisite capability isn't present, but not all capabilities have this. What it requires if that is purely the issue is to follow the WP core code along checking capabilities along the way to see what it wants, but it could also be any number of other things unrelated to that.
    – Tom J Nowell
    Aug 17, 2023 at 10:10

1 Answer 1

2

In Multisite, Core only allows super admins to edit CSS by default. One of the reasons is that there are some security edge cases, especially in older browsers.

To allow site admins, you'll need to grant them the edit_css capability. It sounds like you tried to do that with your plugin, but without seeing the code there's no way to troubleshoot that. You could edit your question to include a minimal reproducible example if you'd like help with that.

Here's an example of how Jetpack does it:

/**
 * Re-map the Edit CSS capability.
 *
 * Core, by default, restricts this to users that have `unfiltered_html` which
 * would make the feature unusable in multi-site by non-super-admins, due to Core
 * not shipping any solid sanitization.
 *
 * We're expanding who can use it, and then conditionally applying CSSTidy
 * sanitization to users that do not have the `unfiltered_html` capability.
 *
 * @param array  $caps Returns the user's actual capabilities.
 * @param string $cap  Capability name.
 *
 * @return array $caps
 */
public static function map_meta_cap( $caps, $cap ) {
    if ( 'edit_css' === $cap ) {
        $caps = array( 'edit_theme_options' );
    }
    return $caps;
}

To mitigate those security problems, you can sanitize the CSS when it's saved. An example of that is how WordCamp.org does it. For more details you can see Sanitize User Entered CSS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.