On my website, I have a CRED admin panel for users (custom role = "partner") who can change different shop data and data related to their shops. This is what they can change:
1) Shop data
- Post Form to add: "Klanteninterface: winkel (bewerken)"
- CRED fields: name, description, opening hours, address, phone, ...
2) Shop brands
- Relation Form to add: "Klanteninterface: winkel merk (toevoegen)"
- CRED fields: brand
3) Shop photos
- Post Form to add: "Klanteninterface: foto per winkel (toevoegen)"
- Post Form to edit: "Klanteninterface: foto per winkel (bewerken)"
- CRED fields: title, photo, alt text, title text
Here's some additional relationship information:
- A shop can have multiple brands and a brand can be linked to multiple shops (many to many)
- A shop can have multiple photo's (repeatable field)
THE PROBLEM
I have a view that lists all the shop photos. There's an add, edit and delete link so you can change photo information. The problem is that the edit and delete links are only showing when I'm logged in as an "administrator" (see "CRED backend - logged in as administrator.PNG"). When I'm logged in as a "partner", the links are gone (see "CRED backend - logged in as partner"). Here's the code for that view:
It's obvious that this is a user right problem. The strange part is that I've checed all the permissions (General, Access, Types & Other) on the custom role "partner" (see "permissions.PNG"). Is there another logical explanation for this strange behavior? Can I make those links visible one way or another?
Hello. Thank you for contacting the Toolset support.
Regarding the delete link for uploaded media using Media Uploader using the Toolset form, we are not allowing the user to delete the media, the core reason behind that is uploaded image can be used with other posts.
We already filed an internal ticket to review the rights and capabilities both in the backend and frontend when the user is using the media uploader to upload the images using Toolset form.
However, if you can send me access details so I can review your current setup and partner role. Please send me admin login as well as partner user login details with problem URL where I can see the uploaded images where edit/delete links are missing.
*** Please make a FULL BACKUP of your database and website.***
I would also eventually need to request temporary access (WP-Admin and FTP) to your site. Preferably to a test site where the problem has been replicated if possible in order to be of better help and check if some configurations might need to be changed.
I have set the next reply to private which means only you and I have access to it.
Now, when you login as partner user - I can see now edit link.
The issue was partner was not set to access the Tooslet Edit for you are using from:
- Access Control -> Toolset Forms -> Post Forms Frontend Access -> Your edit form
=> hidden link
I've checkmark the checkbox for partner role and saved the access settings and I can see now its now Edit links working fine.
Regarding, delete the link, I need to run a deeper test, I will update you as soon as possible.
Hi Minesh! Can you tell me what checkbox you checked exactly? Is it the one under 'Post Forms Frontend Access' > 'Edit Others Custom Post with the Form "Klanteninterface: foto per winkel (bewerken)"'?
If this is affirmative: can other users then update another ones photos?
Hi Minesh! Can you tell me what checkbox you checked exactly? Is it the one under 'Post Forms Frontend Access' > 'Edit Others Custom Post with the Form "Klanteninterface: foto per winkel (bewerken)"'?
===>
Yes - exactly. I checkmark that checkbox. This settings determines to which role you want to grant the access so that they can access the Edit form "Klanteninterface: foto per winkel (bewerken)"'.
If this is affirmative: can other users then update another ones photos?
==>
Well - the view you set is set to query the related entries of repeating field group, so it will display on the related entries only.
Regarding delete link - I need to ran a test, I will get back to you as soon as possible.
Thanks for the explanation Minesh.
FYI: I've activated the maintenance mode (seedprod plugin) for not logged in users so you can do the additional tests.
Hi Minesh, can you please confirm within an hour that things could turn back normal again? The lay-out of the website is broken and I saw there's no content in functions.php anymore. Otherwise, I'm affraid that I have to roll-back to a previous version of the website 🙁
Yes - I can see that functions.php file do not contain any value. Maybe due to internet connection its not uploaded back to server correctly. Can you please restore only functions.php file as I do not make any changes anywhere excluding the checkbox I checked for the partner role.
I need more details about how you created the partner role - I mean using which role you created the partner role? or you just created the custom role with name partner and assigned all capabilities?
Please check the following screenshot where I mark the key capabilities.
=> hidden link
For now - I've set the permissions that user can delete other's posts as well that is why you will be able to see the delete link with the page: hidden link
If you do not allow users that they can delete other's posts, you should simply revoke the delete other's post permission by unchecking the checkbox for the partner's role and save the settings.
For now - I've set the permissions that user can delete other's posts as well that is why you will be able to see the delete link with the page: hidden link;
I've read it a couple of times because things aren't very clear to me. It doesn't feel very logical that I can only display the edit and delete buttons in those repeatable fields by gaining edit and delete access to other users.
If you do not allow users that they can delete other's posts, you should simply revoke the delete other's post permission by unchecking the checkbox for the partner's role and save the settings.
But then I won't be able to delete my own repeatable fields again? :s
In addition to that, if you only want to display the posts whose author is logged in user, you should add a query filter to your view and add post author filter so only posts belong to currently logged in user will be displayed.
I think it's, indeed, best practice to do this. But again: I still have to check that setting so other users can edit and delete my custom posts. It's okay that I know this now, but it doesn't make sence. Unless I totally misunderstand your solution? 🙂
For now - I've set the permissions that user can delete other's posts as well that is why you will be able to see the delete link with the page: hidden link
I've read it a couple of times because things aren't very clear to me. It doesn't feel very logical that I can only display the edit and delete buttons in those repeatable fields by gaining edit and delete access to other users.
==>
This is for your information to let you know.
If you do not allow users that they can delete other's posts, you should simply revoke the delete other's post permission by unchecking the checkbox for the partner's role and save the settings.
But then I won't be able to delete my own repeatable fields again? :s
==>
This is for your information to let you know.
In addition to that, if you only want to display the posts whose author is logged in user, you should add a query filter to your view and add post author filter so only posts belong to currently logged in user will be displayed.
I think it's, indeed, best practice to do this. But again: I still have to check that setting so other users can edit and delete my custom posts. It's okay that I know this now, but it doesn't make sence. Unless I totally misunderstand your solution?
==>
Can you please add the filter I said and we will check this further for delete own and delete other. However, you need to setup repeating field entries belongs to your partner user role then and then it will display the results once you already added the post author = loggedin user filter. Please share the problem URL for which post you added the repeating field entries as partner user so it will get displayed with the view.
Once you add few entries to your repeating field group and filter to view, lets check this further. Sounds good?
