Yes, if you assign ‘promote_users’ to another user, that user could promote non-site admins to site admin. https://codex.wordpress.org/Roles_and_Capabilities#promote_users
Examining the comments for the properties in the WP_User class reveals that allcaps is: All capabilities the user has, including individual and role based. And caps is: The individual capabilities the user has been given. But you probably shouldn’t be using the properties directly. WP_User has a has_cap method that should be used instead, as … Read more
Capability parameter of add_submenu_page() function can only take a single capability, so if you are using the built in roles you can select a capability fro the long list that both administrators and editors have any of these (use any of these freely): moderate_comments manage_categories manage_links unfiltered_html edit_others_posts edit_pages edit_others_pages edit_published_pages publish_pages delete_pages delete_others_pages delete_published_pages … Read more
Although this isn’t well documented, “Super Admin” is not a role (in that it is not an actual role object). It’s more like a special “status”. A list of users who are Super Admins (also called “network admins” or “site admins”) are stored in a database site-option record called site_admins. Generally, adding a capability to … Read more
add_role() will not do anything if the role already exists, so it can’t be used to modify capabilities. To modify capabilities use the add_cap() and remove_cap() method of the WP_Role object. You can get a WP_Role for your role using get_role(): $role = get_role( ‘event-planner’ ); $role->add_cap( ‘edit_others_events’ ); Here’s the thing though, roles are … Read more
Today i got exactly the same behaviour when adding a custom post type. I also noticed some admin post search tools stopped working. My debug_log showed exactly the same notice. The problem turned out to be some text before the <?php opening tag (top file) were I register the CPT. Example some text here<?php /** … Read more
Use remove_cap for this. function remove_proofreader_create_posts(){ global $wp_roles; $wp_roles->remove_cap( ‘proof_reader’, ‘create_posts’ ); $wp_roles->remove_cap( ‘proof_reader’, ‘create_pages’ ); } NOTE: This is not a global function, but a method of the WP_Roles, WP_Role and WP_User classes. It must be called using an instance of one of these classes, as shown in the examples. ALSO: You’ll want to … Read more
I finally managed to get the required behaviour, I ended up using updated code from the example I showed in my question – and actually closer to the code suggested in the question I referenced in my question text! Here is the code that worked in the end: function allow_user_to_edit_cpt_filter($allcaps, $cap, $args) { global $current_user; … Read more
I did not test the following code, but it should do what you want (or point you in the right direction, at least). function captains_user_row_actions($actions, $user) { // remove the ability to edit a non-team-member $cap_team_id = get_user_meta(wp_get_current_user()->ID, ‘team-meta’, true); $user_team_id = get_user_meta($user->ID, ‘team-meta’, true); if (‘users.php’ === $GLOBALS[‘pagenow’] && $cap_team_id !== $user_team_id) unset($actions[‘edit’]); return … Read more
I found a few references to edit_user as a capability, one of which is this: // Allow user to edit itself if ( ‘edit_user’ == $cap && isset( $args[0] ) && $user_id == $args[0] ) break; http://core.trac.wordpress.org/browser/tags/3.5.2/wp-includes/capabilities.php#L1005 I believe the comment in that block of code answers this question. Per @PatJ, it looks like map_meta_cap … Read more