[Resolved] Which Capability is required to change/assign Additional Roles

[Author]

Posts

[philippeS-4]

I have a role Shop Manager who is a non administrator and I would it to be able to change/assign Additional Roles to user. I have been playing around with different capabilities using the Access plugin but can't figure out which one is required.

On the attached picture the sam user is being viewed with Admin role on the left and Shop Manager on the right.

Thanks for your help,

[Minesh]

Hello. Thank you for contacting the Toolset support.

As you can see with the following official WordPress doc - to display the roles dropdown you should assign "promote_users" capability:
=> https://wordpress.org/support/article/roles-and-capabilities/#promote_users

[philippeS-4]

Hi Minesh,

Thanks for your reply, the promote users capability has been assigned to the Shop Manager role. Yes I can see the primary role but the other "Additional Roles" created with Access are not available like for the Administrator.

See picture in my previous message

Thanks,

[Minesh]

The additional roles section is displayed by any third-party plugin?

[philippeS-4]

I don't think it is since the link "using multiple roles per user" takes you to a toolset page - So I think it is Toolset Access which add this!

https://toolset.com/documentation/user-guides/access-control/managing-wordpress-admin-capabilities-access/#using-multiple-roles-per-user

and yes I have removed the tick on the Do not allow.... as per the page

[Minesh]

Can you please share admin access details as well as access details for the Shop Manager role user (as I understand, you want to allow Shop Manager user to control the roles) correct?

*** Please make a FULL BACKUP of your database and website.***
I would also eventually need to request temporary access (WP-Admin and FTP) to your site. Preferably to a test site where the problem has been replicated if possible in order to be of better help and check if some configurations might need to be changed.

I have set the next reply to private which means only you and I have access to it.

[Minesh]

I try to reproduce the issue with the clean WordPress site where only Toolset + Woocommerce plugin installed and I assigned the capabilities like (promote_users,edit_user,list_users) to Shop Manager role and then created few users with customer and subscriber role.

After that I logged in as shop manager role but when I try to edit the customer user I do not see all roles listed with the "Additional Roles" section. It looks like there is the issue and I've escalated this issue in front of our next-level support. Please hold on for further updates.

[Minesh]

I got the news forn our next level support that this does not issue in Access.

As you know Access has an option to remove high-level roles from the list of editable_roles.
=> https://toolset.com/documentation/user-guides/access-control/managing-wordpress-admin-capabilities-access/#prevent-modifying-users-with-higher-privileges

The same filter exists in WooCommerce 'wc_modify_editable_roles'.

add_filter( 'editable_roles', 'wc_modify_editable_roles' );
add_filter( 'user_has_cap', 'wc_customer_has_capability', 10, 3 ); 

which is added to file plugins/woocommerce/includes/wp-user-functions.php

If you want to allow WC users to manage other users you have to disable that filter from WooCommerce. Access do not have any solution for this as the filter is added from WooCommerce.

[philippeS-4]

Hi Minesh,

Thanks for the info, the code provided didn't help with the solution, also changing the file would have meant that at next update I would be back to square one.
Once I understood the issue came from the Woo Shop Manager role and proved that Toolset was not the problem by just assigning the correct role to a basic user I came to the conclusion that if I create a duplicate role of Woo Shop Manager and assign the capabilities required to assign additional roles it should work and it did.
So brilliant! Thanks for putting in the right direction!