0

I'm perplexed; I can't see where I'm going wrong with this code. It should redirect any subscriber-level users back to the site home page if they try to access anything within /wp-admin - but not if they try to go to /wp-login.php :

// REDIRECT ALL 'SUBSCRIBER' USERS TO SITE HOME PAGE IF THEY TRY TO ACCESS WP-ADMIN
add_action( 'init', 'blockusers_init' );
function blockusers_init() {
    if ( !current_user_can( 'edit' ) && is_admin() ) {
        wp_redirect( home_url() );
        exit;
    }
}

I tried using the role instead of capability ('subscriber' instead of 'edit'), and that worked when I was on a single-site installation of WordPress - but this theme is now being used in a multisite/subfolder installation and for some reason the role doesn't work. Using the code above, anytime a subscriber goes to either /wp-admin or /wp-login.php they get redirected to the home page.

Any ideas? Thanks for your help!

3
  • I added this my functions file in a vanilla WP install, and it doesn't redirect me when I hit wp-login. Have you tried disabling all plugins? Also, "edit" isn't a capability, unless it's custom to your install: codex.wordpress.org/Roles_and_Capabilities
    – MathSmath
    May 10, 2012 at 23:52
  • thank you! I must be going blind. Sadly it still doesn't work in multisite, but at least that's one potential issue eliminated. I did try disabling all plugins and that didn't have any effect.
    – Michelle
    May 11, 2012 at 15:50
  • My bad--I didn't try it on a multisite install.
    – MathSmath
    May 14, 2012 at 16:26

1 Answer 1

3

So, first off, if you want to block access to wp-admin, why hook into something that fires on every page load? Hook into admin_init instead.

And, as @MattSmath mentioned, edit isn't a capability. edit_posts is. Also, admin_init only fires on admin pages, so you can remove is_admin() from your check.

Your revised function:

<?php
add_action('admin_init', 'wpse51831_init');
function wpse51831_init()
{
    if(!current_user_can('edit_posts')) 
    {
        wp_redirect(home_url());
        exit();
    }
}

Bonus: You're probably not going to want to show your subscriber level users the WordPress admin bar (which links them back to wp-admin). This will hide it:

<?php
add_filter('show_admin_bar', 'wpse51831_hide_admin_bar');
/*
 * hide the admin bar for `subscribers`
 *
 * @uses current_user_can
 * @return boolean
 */
function wpse51831_hide_admin_bar($bool)
{
    if(!current_user_can('edit_posts'))
    {
        $bool = false;
    }
    return $bool;
}
3
  • The "admin" bar is not an admin bar in 3.4, it's a generic toolbar that, in many cases, is integrated into the theme. +1 for the code to fix the admin, -1 for hiding a somewhat essential core feature.
    – EAMann
    May 11, 2012 at 4:30
  • Thank you for both these! Man do I feel dumb for not seeing the edit_posts thing. Unfortunately though even with the new code, it's still not working. /wp-admin redirects correctly, but wp-login.php also redirects. Maybe it's a multisite thing? Because it does work on a single-install of WP with the same plugins enabled.
    – Michelle
    May 11, 2012 at 15:47
  • 2
    Also thanks for the hiding admin bar filter, I actually already had that working. @EAMann, in my case I am using the login system only to show/hide certain content, and I really don't want any subscribers to see any part of the dashboard or WP functionality. So hiding the bar seems appropriate.
    – Michelle
    May 11, 2012 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.