I tried to enable "publish posts", "edit posts" and "allow upload media" without any luck.
There is still some magic setting that needs to be enabled to make it work.
I've had to escalate this thread for second tier to see if they can identify why the permissions don't seem to work as expected with the organizer role.
I'm just reviewing my escalated threads from over the holidays.
The internal ticket for this is in-progress, but my colleague linked to the core WP ticket where people have been complaining about the lack of separate permissions for Media, which as I noted above are linked to permissions for Posts, for 6 years: https://core.trac.wordpress.org/ticket/19834
I went back to my local installation of your test site, under Toolset > Access Control, I went to the settings for standard Posts and allowed the Organizer role to publish Posts.
I then tested an Organizer user and they were able to see the Add Media button on a CRED form.
I don't think any amount of tweaking of the individual permission settings will help if the role does not have Publish permission for standard Posts.
On my local copy of your test site I have an Organiser test user, organiser role is set to allow editing and publishing posts, and also has the upload_files permission.
I re-tested having the organiser viewing a form on the front-end and it does see the Add Media button (and it works).
Upgraded all Toolset plugins to latest.
Access 2.4.3.5
CRED 1.9.4
Layouts 2.2
Maps 1.4.1
Types 2.2.21
Views 2.5.2
Disabled all but Toolset
Activated Toolset Starter theme 1.4.2
Tried to swap site language
Activated following capabilities on (existing) user role "Organizer Large"
General Capabilities/upload_files
Other capabilities/publish_posts
Other capabilities/edit_posts
Tried these forms
/wp-admin/post.php?post=5874&action=edit
/wp-admin/post.php?post=5840&action=edit
That are used with post-type tab
/wp-admin/edit.php?post_type=tab
I went back into your staging site rather than use my local copy to make sure we are both looking at the same thing.
The previous credentials for an Organiser Large test user didn't seem to work, so I created a test user with that role ("toolset"), created a test form ("Test publish Upplysning") and inserted this on a test page ("CRED: Test publish Upplysning").
When visiting that page with the Organiser Large user I could not see the Add Media button.
So I double-checked your Access settings.
The Organiser Large role doesn't have permission to publish posts, and because of the limitation of WordPress I described previously, they cannot publish Media regardless of what permissions you set in Access. Media permissions cannot be more permissive than post permissions.
The developers of WordPress don't recognise the possibility that someone might need permission to upload an image that doesn't already have permission to publish posts.
That is a big difference and another settings page !
I didn't enable publish posts there, I enabled it on the tab "custom Roles".
But that also gave the user access to CRED forms, Fields and views and Access buttons. (or did you enable something else?)
That is something I really don't want the user to be able to access.
Also the user sees the entire media library...
Sorry, that's what I've been referring to all along.
If you don't want the various Toolset buttons to appear on the front end you need to disable them using code.
Try the following:
/**
* Remove Toolset buttons on front-end editors
* which appear for role author+ when insert
* media option set on CRED forms
*
* The filters work globally, so you will need
* to add a test, e.g. for the page where the
* CRED form is added
*/
function remove_toolset_buttons(){
// $post not available with init hook
$postID = url_to_postid( $_SERVER['REQUEST_URI'] , '_wpg_def_keyword', true );
$target_pages = array( 10, 25, 66 ); // Edit for pages with CRED forms
if ( in_array( $postID, $target_pages ) ) {
// remove the Fields and Views button
add_filter( 'toolset_editor_add_form_buttons', '__return_false' );
// remove the CRED button
add_filter( 'toolset_cred_button_before_print', '__return_false' );
// remove the Access button for certain roles
add_filter( 'toolset_editor_add_access_button', function(){
$roles = array( 'author', 'subscriber' );
return $roles;
} );
}
}
add_action( 'init', 'remove_toolset_buttons' );
