[Waiting for user feedback] Custom user role doesn’t see all users

[Author]

Posts

[Marcel]

I added a new role via Toolset Access custom roles. A user with this role should be able to edit the role of other users. But a user with this role only sees users with 1 specific custom role, and can only choose from 4 roles. So therefor, that role only sees 40 of 444 users.

According to ChatGPT, there should be a setting "Do not allow users to edit other users with higher roles." which would explain this, but I dont see that setting.

[Christopher Amirian]

Hi,

Welcome to Toolset support. I did not hear of an option called "Do not allow users to edit other users with higher roles" so I am not sure about that.

Toolset Access saves custom roles the same way WordPress saves its built-in roles. So what a user can do in "Users" depends on WordPress capabilities, and plugins or code can change the result.

In WordPress, the roles a user can assign come from a list that plugins can filter.

Changing another user's role needs the edit_users capability.

Please check:

- Open the role in "Toolset → Access Control", "Custom Roles" tab. Confirm it can list users, edit users and promote users (the capabilities list_users, edit_users and promote_users).
- Create a backup first, then test on a copy of the site. Deactivate all plugins except Toolset Types and Toolset Access, and switch to a default theme such as Twenty Twenty. Log in as a user with this role and check the Users list and the role dropdown. If all 444 users and all roles appear, reactivate your plugins one by one to find the one that limits them.
- Check Toolset → Settings → Custom Code" and your theme functions.php for code that uses the editable_roles filter or restricts the user list.

Finally, please make sure you followed the documentation steps:

https://toolset.com/course-lesson/setting-up-custom-roles-for-members/

Thanks.

[Marcel]

Hi,

Thanks for your reply. I've narrowed down the issue further.

- My custom role "Schepen manager" already has `list_users`, `edit_users` and `promote_users`.
- WordPress has 444 users.
- When logged in as Schepen manager, the Users page only displays users with the "Havenmeester" role (38 users).
- Searching for users with other roles also returns no results.
- An Administrator can see all users.
- Disabling all plugins except for types and access, and switching to twentytwentyfive theme doesn't solve it either.

However, Disabling Toolset Access immediately resolves the issue. All users become visible again.

This suggests that Toolset Access is filtering the WordPress user query based on role permissions.

Could you identify which Toolset Access function or filter restricts the Users list, and how to configure it so Schepen manager can see all users while still being prevented from assigning Administrator, Editor, Schepen manager, Translator and Havenmeester roles?

I'd prefer to solve this without disabling Toolset Access or granting administrator-level capabilities.

[Christopher Amirian]

Hi,

Thank you. A quick test: create a second custom role, copy privileges from "Editor", and grant list_users, edit_users and promote_users. Assign it to a test user and check the Users page. Tell me if all 444 users appear.

To limit the roles "Schepen manager" can assign, WordPress has the editable_roles filter. Custom code is outside our support scope, but please check this.

Replace the slugs with your real role slugs:

add_filter( 'editable_roles', 'limit_roles_for_schepen_manager' );
function limit_roles_for_schepen_manager( $roles ) {
	$user = wp_get_current_user();
	if ( in_array( 'schepen-manager', (array) $user->roles, true ) ) {
		$blocked = array( 'administrator', 'editor', 'schepen-manager', 'translator', 'havenmeester' );
		foreach ( $blocked as $role_slug ) {
			unset( $roles[ $role_slug ] );
		}
	}
	return $roles;
}

This only limits the roles in the dropdown. With a test user, check whether this role can still edit existing Administrator accounts.

If not, please create a copy/staging version of the website and get back to us with the login information in a private message so that we can check without the fear or breaking a live website.

Also please tell us which users to check as a test.

Thanks

[Christopher Amirian]

Hi,

Thank you, but is this a copy/staging website? It seems to be a live website. If so I will not be able to do troubleshooting there.

Please provide the login information of a copied website.

Thanks.