1

I allow the author user role to add/edit posts (using a custom post type called "User Posts") as well as add/edit their own media from wp-admin. I currently have it set up so that the only menu items they see are the "User Posts" "New User Post" "Media" and "Upload Media", with these URLs: post-new.php?post_type=tsv_userpost edit.php?post_type=tsv_userpost upload.php media-new.php

The only problem is that if the user types in the URL of, for instance, post-new.php (without the custom post type part) Wordpress still allows them to see that page. No bueno.

Is there a way to redirect or display an error message to users if they are not admins and if they land on any wp-admin page EXCEPT the above URLs?

I have tried using this code (just for the post-new.php page) from another thread, but it doesn't seem to do anything:

//Show error message if authors try to access wrong wp-admin pages
add_action('admin_head','my_restrict_access');
function my_restrict_access_meassage(){
    global $pagenow;
    if ($pagenow == 'post-new.php' && !current_user_can( 'switch_themes' )){
        echo '<div class="wrap"><br />
            <div id="message" class="error">You Dont have the right permissions to access this page</div>
        </div>';
        exit();
    }
}

Thanks is advance.

EDIT: Here's the code I ended up with that works:

        //Restrict access to authors in wp-admin pages
    //Show error message if authors try to access wrong wp-admin pages
    add_action('admin_head','my_restrict_access');
    function my_restrict_access(){
        $Path=$_SERVER['REQUEST_URI'];
        $basepath='http://www.theseattlevine.com/wordpress/wp-admin';
        $URI='http://www.theseattlevine.com'.$Path;

            if      (   ($URI ==($basepath . '/post-new.php')) && !current_user_can ('manage_categories') ) {
                        echo    '<div class="wrap"><br />
                                    <div id="message" class="error">You Dont have the right permissions to access this page. Try these links instead: 
                                        <ul>
                                            <li><a href="/">The Vine Homepage</a></li>
                                            <li><a href="/wordpress/wp-admin/post-new.php?post_type=tsv_userpost">Add a new user post</a></li>
                                            <li><a href="/dashboard">Your dashboard</a></li>
                                        </ul>
                                    </div>
                                </div>';
                        exit();
                        }
            elseif      (   ($URI ==($basepath . '/edit.php')) && !current_user_can ('manage_categories') ) {
                        echo    '<div class="wrap"><br />
                                    <div id="message" class="error">You Dont have the right permissions to access this page. Try these links instead: 
                                        <ul>
                                            <li><a href="/">The Vine Homepage</a></li>
                                            <li><a href="/wordpress/wp-admin/post-new.php?post_type=tsv_userpost">Add a new user post</a></li>
                                            <li><a href="/dashboard">Your dashboard</a></li>
                                        </ul>
                                    </div>
                                </div>';
                        exit();
                        }

    }
4
  • Oh, and I'm not looking for a plugin solution. Just a function of some sort. Thanks.
    – Eckstein
    Dec 30, 2012 at 23:30
  • 1
    make sure that the second parameter in the "add_action" function matches the name of your restrict access function. It should look something like this: add_action('admin_head','my_restrict_access'); function my_restrict_access(){ /* code as before */ }
    – Jen
    Dec 31, 2012 at 19:54
  • Oh duh! I was so busy focusing on the functionality I forgot basic things like checking the name of the function.... Anyway, I updated my questions with the code I used to restrict the two pages I was having issue with in case it's useful to anyone. If you want to add an answer, I can select you as the winner. Up to you. Thanks!
    – Eckstein
    Jan 1, 2013 at 1:43
  • 1
    Post your solution as an answer.
    – fuxia
    Jan 1, 2013 at 16:59

1 Answer 1

1

Make sure that the second parameter in the "add_action" function matches the name of your restrict access function. It should look something like this:

add_action('admin_head','my_restrict_access'); 
function my_restrict_access(){ /* code as before */ } 

Glad I could help. :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.