[Resolved] Stop custom user changing their access permissions

[Author]

Posts

[Ben]

I am trying to set up a Custom Role in Access Control for a user just below an Admin but above Editor.

I have copied the Permissions from Editor and I believe the attached permission is the one that I need to enable for a User to be able to view and use plugins in the WP admin area.

The problem I have is that when I enable this, the user can navigate to Toolset Access and change their own permissions, thus giving them access to things they should not be able to.

Is there any way to stop this? Or am I using this wrong?

[Luo Yang]

Hello,

Thanks for the details, in your case, I suggest you try this:
Dashboard-> Toolset-> Access Control-> Custom Roles
click button "Enable advanced mode"
find and "Change permissions" of your custom user role, in section "General capabilities"
1) Disable option "manage_options"
Then those users can not see Toolset memu

2) Enable options:
activate_plugins
Then those users can see Plugin memu, and activate/deactivate plugins in your website.

More help:
https://codex.wordpress.org/Roles_and_Capabilities#activate_plugins

[Ben]

Hello Luo Yang,

Thank you for your suggestions. I don't think I explained what I was trying to achieve well enough.

I want the user to be able to use the Toolset plugins, just not be able to change their own, or anyone else's, Access settings.

[Luo Yang]

You can remove the "Access Control" menu like this:

function no_access_menu() {
	$user = wp_get_current_user();
	if ( in_array( 'editor', (array) $user->roles ) ) { 
		$page = remove_submenu_page( 'toolset-dashboard', 'types_access' );
	}
}
add_action( 'admin_menu', 'no_access_menu', 999 );

Please replace "editor" with your custom user role slug.

More help:
https://developer.wordpress.org/reference/functions/remove_submenu_page/

[Ben]

Thank you Luo Yang, that has worked perfectly!

[Luo Yang]

You are welcome