[Resolved] Add Media button not visible in CRED form

[Author]

Posts

[tinaH]

I tried to enable "publish posts", "edit posts" and "allow upload media" without any luck.
There is still some magic setting that needs to be enabled to make it work.

[Nigel]

Hi Tina

To simplify this I created a simple test form and an Organiser user to test it with, switched to 2017 theme and disabled all non-Toolset plugins.

I went through pretty much every permutation or combination of role privileges and couldn't get anything to work.

I double-check things in the morning, but I think I will need to escalate this so another pair of eyes can try and find the source of the problem.

[Nigel]

Hi Tina

Still no joy.

I've had to escalate this thread for second tier to see if they can identify why the permissions don't seem to work as expected with the organizer role.

I'll keep you posted.

[Nigel]

Hi Tina

I'm just reviewing my escalated threads from over the holidays.

The internal ticket for this is in-progress, but my colleague linked to the core WP ticket where people have been complaining about the lack of separate permissions for Media, which as I noted above are linked to permissions for Posts, for 6 years: https://core.trac.wordpress.org/ticket/19834

I went back to my local installation of your test site, under Toolset > Access Control, I went to the settings for standard Posts and allowed the Organizer role to publish Posts.

I then tested an Organizer user and they were able to see the Add Media button on a CRED form.

I don't think any amount of tweaking of the individual permission settings will help if the role does not have Publish permission for standard Posts.

Can you check that on your own site?

[tinaH]

I already tested this, activating post publish permission does not help on my site.

[Nigel]

Hi Tina

An erratum was published about this issue here: https://toolset.com/errata/unable-to-set-permissions-for-custom-role-to-see-add-media-button-on-a-cred-form/

On my local copy of your test site I have an Organiser test user, organiser role is set to allow editing and publishing posts, and also has the upload_files permission.

I re-tested having the organiser viewing a form on the front-end and it does see the Add Media button (and it works).

Could you check again, please?

[tinaH]

Still not working:

I tried this:

Upgraded all Toolset plugins to latest.
Access 2.4.3.5
CRED 1.9.4
Layouts 2.2
Maps 1.4.1
Types 2.2.21
Views 2.5.2

Disabled all but Toolset
Activated Toolset Starter theme 1.4.2
Tried to swap site language

Activated following capabilities on (existing) user role "Organizer Large"
General Capabilities/upload_files
Other capabilities/publish_posts
Other capabilities/edit_posts

Tried these forms
/wp-admin/post.php?post=5874&action=edit
/wp-admin/post.php?post=5840&action=edit

That are used with post-type tab
/wp-admin/edit.php?post_type=tab

[Nigel]

Hi Tina

I went back into your staging site rather than use my local copy to make sure we are both looking at the same thing.

The previous credentials for an Organiser Large test user didn't seem to work, so I created a test user with that role ("toolset"), created a test form ("Test publish Upplysning") and inserted this on a test page ("CRED: Test publish Upplysning").

When visiting that page with the Organiser Large user I could not see the Add Media button.

So I double-checked your Access settings.

The Organiser Large role doesn't have permission to publish posts, and because of the limitation of WordPress I described previously, they cannot publish Media regardless of what permissions you set in Access. Media permissions cannot be more permissive than post permissions.

The developers of WordPress don't recognise the possibility that someone might need permission to upload an image that doesn't already have permission to publish posts.

[tinaH]

That is a big difference and another settings page !
I didn't enable publish posts there, I enabled it on the tab "custom Roles".

But that also gave the user access to CRED forms, Fields and views and Access buttons. (or did you enable something else?)
That is something I really don't want the user to be able to access.
Also the user sees the entire media library...

Any ideas?

[Nigel]

Sorry, that's what I've been referring to all along.

If you don't want the various Toolset buttons to appear on the front end you need to disable them using code.

Try the following:

/**
* Remove Toolset buttons on front-end editors
* which appear for role author+ when insert
* media option set on CRED forms
*
* The filters work globally, so you will need
* to add a test, e.g. for the page where the
* CRED form is added
*/
function remove_toolset_buttons(){

	// $post not available with init hook
	$postID = url_to_postid( $_SERVER['REQUEST_URI'] , '_wpg_def_keyword', true );
	$target_pages = array( 10, 25, 66 ); // Edit for pages with CRED forms


	if ( in_array( $postID, $target_pages ) ) {
		// remove the Fields and Views button
		add_filter( 'toolset_editor_add_form_buttons', '__return_false' );

		// remove the CRED button
		add_filter( 'toolset_cred_button_before_print', '__return_false' );

		// remove the Access button for certain roles
		add_filter( 'toolset_editor_add_access_button', function(){
			$roles = array( 'author', 'subscriber' );
			return $roles;
		} );
	}
}
add_action( 'init', 'remove_toolset_buttons' );

There are no settings to control access to the Media Library with Toolset, but the example on the following page works to limit the Media Library to a user's own content: https://codex.wordpress.org/Plugin_API/Filter_Reference/ajax_query_attachments_args

[tinaH]

Replying to keep ticket open. Have not had the time to test yet.

[Nigel]

Sure, let me set this as waiting for feedback from you.