I allow the author user role to add/edit posts (using a custom post type called "User Posts") as well as add/edit their own media from wp-admin. I currently have it set up so that the only menu items they see are the "User Posts" "New User Post" "Media" and "Upload Media", with these URLs: post-new.php?post_type=tsv_userpost edit.php?post_type=tsv_userpost upload.php media-new.php
The only problem is that if the user types in the URL of, for instance, post-new.php (without the custom post type part) Wordpress still allows them to see that page. No bueno.
Is there a way to redirect or display an error message to users if they are not admins and if they land on any wp-admin page EXCEPT the above URLs?
I have tried using this code (just for the post-new.php page) from another thread, but it doesn't seem to do anything:
//Show error message if authors try to access wrong wp-admin pages
add_action('admin_head','my_restrict_access');
function my_restrict_access_meassage(){
global $pagenow;
if ($pagenow == 'post-new.php' && !current_user_can( 'switch_themes' )){
echo '<div class="wrap"><br />
<div id="message" class="error">You Dont have the right permissions to access this page</div>
</div>';
exit();
}
}
Thanks is advance.
EDIT: Here's the code I ended up with that works:
//Restrict access to authors in wp-admin pages
//Show error message if authors try to access wrong wp-admin pages
add_action('admin_head','my_restrict_access');
function my_restrict_access(){
$Path=$_SERVER['REQUEST_URI'];
$basepath='http://www.theseattlevine.com/wordpress/wp-admin';
$URI='http://www.theseattlevine.com'.$Path;
if ( ($URI ==($basepath . '/post-new.php')) && !current_user_can ('manage_categories') ) {
echo '<div class="wrap"><br />
<div id="message" class="error">You Dont have the right permissions to access this page. Try these links instead:
<ul>
<li><a href="/">The Vine Homepage</a></li>
<li><a href="/wordpress/wp-admin/post-new.php?post_type=tsv_userpost">Add a new user post</a></li>
<li><a href="/dashboard">Your dashboard</a></li>
</ul>
</div>
</div>';
exit();
}
elseif ( ($URI ==($basepath . '/edit.php')) && !current_user_can ('manage_categories') ) {
echo '<div class="wrap"><br />
<div id="message" class="error">You Dont have the right permissions to access this page. Try these links instead:
<ul>
<li><a href="/">The Vine Homepage</a></li>
<li><a href="/wordpress/wp-admin/post-new.php?post_type=tsv_userpost">Add a new user post</a></li>
<li><a href="/dashboard">Your dashboard</a></li>
</ul>
</div>
</div>';
exit();
}
}
add_action('admin_head','my_restrict_access'); function my_restrict_access(){ /* code as before */ }