How to change WordPress User Role capabilities

User Roles

User Roles


Every WordPress blog owner knows that WordPress 2.8 and higher user standard roles are: Administrator, Editor, Author, Contributor, Subscriber.
What is the difference? What the “Author” can do but “Contributor” can not? Comprehensive information about it can be found here, at WordPress.org
But where all that data are stored? How to change the role if you really need it? Interested? Read this article and you will get some answers on that questions. Recently I met with the following problem at the multi-authored blog. User with role “Author” can upload images to the blog server, but can not use it in his/her posts. Any HTML tags are immediately hidden from post text after “Author” saves his draft or post. The same user with role “Editor” stores post with all HTML tags he includes in it with success. The problem is that WordPress automatically applies HTML filters to all author’s content if he has not “unfiltered_html” capability in his role. The “Author” role has not such capability in WordPress by default. So if you wish to give your authors the ability to include images or other media staff into their posts, you are in the right place.
First of all, user roles data are stored in the MySQL database table which is named ‘wp_options’ by default. You need to have one of MySQL client software (MyPHPAdmin, MySQLyog, etc.) to connect to your blog MySQL database and go ahead with text of this post further.
This SQL command help you find the record containing information about WordPress user roles:

SELECT * FROM wp_options WHERE option_name="wp_user_roles"

As the result we can see that user roles data is stored in the option_value field as the text string of the special format. To be exact, it is a format which can be used to read from and write to the PHP array.

a:5:{
s:13:"administrator";a:2:{s:4:"name";s:13:"Administrator";s:12:"capabilities";a:54:{s:13:"switch_themes";b:1;s:11:"edit_themes";b:1;s:16:"activate_plugins";b:1;s:12:"edit_plugins";b:1;s:10:"edit_users";b:1;s:10:"edit_files";b:1;s:14:"manage_options";b:1;s:17:"moderate_comments";b:1;s:17:"manage_categories";b:1;s:12:"manage_links";b:1;s:12:"upload_files";b:1;s:6:"import";b:1;s:15:"unfiltered_html";b:1;s:10:"edit_posts";b:1;s:17:"edit_others_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:10:"edit_pages";b:1;s:4:"read";b:1;s:8:"level_10";b:1;s:7:"level_9";b:1;s:7:"level_8";b:1;s:7:"level_7";b:1;s:7:"level_6";b:1;s:7:"level_5";b:1;s:7:"level_4";b:1;s:7:"level_3";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:17:"edit_others_pages";b:1;s:20:"edit_published_pages";b:1;s:13:"publish_pages";b:1;s:12:"delete_pages";b:1;s:19:"delete_others_pages";b:1;s:22:"delete_published_pages";b:1;s:12:"delete_posts";b:1;s:19:"delete_others_posts";b:1;s:22:"delete_published_posts";b:1;s:20:"delete_private_posts";b:1;s:18:"edit_private_posts";b:1;s:18:"read_private_posts";b:1;s:20:"delete_private_pages";b:1;s:18:"edit_private_pages";b:1;s:18:"read_private_pages";b:1;s:12:"delete_users";b:1;s:12:"create_users";b:1;s:17:"unfiltered_upload";b:1;s:14:"edit_dashboard";b:1;s:14:"update_plugins";b:1;s:14:"delete_plugins";b:1;s:15:"install_plugins";b:1;s:13:"update_themes";b:1;s:14:"install_themes";b:1;}}
s:6:"editor";a:2:{s:4:"name";s:6:"Editor";s:12:"capabilities";a:34:{s:17:"moderate_comments";b:1;s:17:"manage_categories";b:1;s:12:"manage_links";b:1;s:12:"upload_files";b:1;s:15:"unfiltered_html";b:1;s:10:"edit_posts";b:1;s:17:"edit_others_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:10:"edit_pages";b:1;s:4:"read";b:1;s:7:"level_7";b:1;s:7:"level_6";b:1;s:7:"level_5";b:1;s:7:"level_4";b:1;s:7:"level_3";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:17:"edit_others_pages";b:1;s:20:"edit_published_pages";b:1;s:13:"publish_pages";b:1;s:12:"delete_pages";b:1;s:19:"delete_others_pages";b:1;s:22:"delete_published_pages";b:1;s:12:"delete_posts";b:1;s:19:"delete_others_posts";b:1;s:22:"delete_published_posts";b:1;s:20:"delete_private_posts";b:1;s:18:"edit_private_posts";b:1;s:18:"read_private_posts";b:1;s:20:"delete_private_pages";b:1;s:18:"edit_private_pages";b:1;s:18:"read_private_pages";b:1;}}
s:6:"author";a:2:{s:4:"name";s:6:"Author";s:12:"capabilities";a:10:{s:12:"upload_files";b:1;s:10:"edit_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:4:"read";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:12:"delete_posts";b:1;s:22:"delete_published_posts";b:1;}}
s:11:"contributor";a:2:{s:4:"name";s:11:"Contributor";s:12:"capabilities";a:5:{s:10:"edit_posts";b:1;s:4:"read";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:12:"delete_posts";b:1;}}
s:10:"subscriber";a:2:{s:4:"name";s:10:"Subscriber";s:12:"capabilities";a:2:{s:4:"read";b:1;s:7:"level_0";b:1;}}}

Here we see that:

  • a:number:{ is the begin of array and “number” is the number of array elements. For example “a:5:{” at the begin of the string means that roles array consists of 5 element. Remember that WordPress has exactly 5 roles.
  • s:number:"string"; – “s” is the type of string element, number is the quant of chars in the string. E.g. s:6:"author";
  • b:1; – means the Boolean element with value “1″ or “True”
  • That’s almost all. We can see that capabilities are stored inside roles in the “Name-Bolean value” format. Now we must to find the “unfiltered_html” capability in the “Editor” role, copy the sequence s:15:"unfiltered_html";b:1; from there and paste it into the “Author” role, just after s:12:"upload_files";b:1; capability. To finish the role change we have to increase to 1 the quant of elements in the “Author” role array. By default the “Author” role has 10 capabilities or in this special format a:10:{s:12:"upload_files". To finish the role update we need to change 10 to 11, and finally have this a:11:{s:12:"upload_files" inside the “Author” role.
    What is left? Just update MySQL table wp_options to store your changes. Use this SQL command for that:

     UPDATE `wp_options` 
    SET option_value='changed value here' WHERE option_id=NN;

    Do not forget to replace ‘changed value here’ with modified user roles data from the previous query and ‘NN’ on the wp_user_roles record Id from the same query.
    Warning! Make a backup of wp_options table first. Just after making the fresh backup go ahead with any update SQL command.

    Congratulations, we changed WordPress user role without change the line of PHP code.

    I have the information about WordPress user roles storage mechanism from this file wp-admin\includes\schema.php

    If you wish to change user role capabilities for the WordPress MU blog please read “How to change WordPress MU user role capabilities” post.

    If material shown above is little difficult for you or you have new ideas about user role capabilities valid list more often than 1 time a year consider to use my “User Role Editor” WordPress plugin.
    It offers user interface to make the correction of the user role data easy and convenient way.
    Thank you.

    Tags: Security, WordPress

  • zyan
    hi there can you help figuring this out? i am new in this stuff and dont have any idea what are meta key are... it gives me headache... i want to change my site into new url..so i google and search the easiest way and found out your site....
    i only need to change this..

    UPDATE `newprefix_usermeta` SET `meta_key` = REPLACE( `meta_key` , 'oldprefix_', 'newprefix_' );

    where i can get those code? or please suggest anything that i will just copy and paste in my php tool.. pls... thannk you soo much..i will be glad if you will help me... :)

    zyn
  • Hi,
    If you wish to change site to new URL only, what is the reason to change WP database prefix? Why not to use the old one? Please give me more details about what do you wish to complete? What do you wish to make? And I will help you with SQL commands you need to use for that, possibly.
  • cikkus
    Hi Vladimir need you help:
    After an hacker's attack I had to clean several file and renamed all suffix database's tables. But when i tried to modify "wp_user_roles" can't find it in my SQL under wp_options this record. I stay amazed and I checked several time into the row to find user_roles, but i didn't have it! So after configuring wp-config.php I visited the site. All perfect, but when I tried to log as admin it return me the classical " you dont'have right permission..."
    So I thing it depend for the user-roles lacks but can't understand as it's possible. I used your query . SELECT * FROM wp_options WHERE option_name="wp_user_roles" but i hadn't any result...
    Could you please help me? Couls i recreate the missing table? Thanks!
  • Hi,
    First, try to check your existing options table, of course with use of new db_prefix using wildcard %, e.g.
    SELECT * FROM wp_options WHERE option_name like "%user_roles"
    "wp_" in the query you use is the default db prefix as in table name, as in the option_name both.
    After you find/rename/restore this record. You should to check wp_usermeta table and change your admin user capability record meta_key from 'wp_' to your new db prefix.
    try this query
    SELECT * FROM wp_usermeta WHERE meta_key like "wp_%" and user_id=1
    and change all 'wp_' in the records to your new db prefix.
    I hope that will help you.
  • Great! You are great! Thank alot! Just when I launched the query you have suggested me it appeared the record with the old suffix...So i changed the old with the new suffix and I finally could enter my site as administrator! Thanks from Italy! Francesco
  • You are welcome! :)
  • Flash Arcade Games
    Hi,
    I am having some problem with my wp. 2.8. I can't delete any user/posts/pages or upgrade any plugins using the dashboard. I keep getting messages like -
    1)You do not have sufficient permissions to access this page.
    2)You do not have sufficient permissions to update plugins for this blog.
    2)You can’t delete users.
    .
    .
    I would appreciate if somebody could help me to resolve this.
    Thanks
  • Hi,
    I suppose that you not write about WordPress MU. Can you create new user?
    If you can create one and assign him the administrator role. Relogin under new admin user and check what role is assigned to your old admin user. If it was changed restore it.
    If you can not create new user you need to check your user current role using SQL queries like
    1) select ID from wp_users where user_login='admin'
    change wp_ to your WordPress database prefix and admin to your user name
    2) select * from wp_usermeta where user_id=1 and meta_key='wp_capabilities'
    change wp_ to your WordPress database prefix and 1 to your user ID from the previous query
    Check the result, to edit those items you wrote about you need to have administrator role, that is the result for meta_value field must be
    a:1:{s:13:"administrator";b:1;}
    If you have it but still can not do admin tasks in your blog, your administrator role is edited by someone.
    Do you have URE plugin installed already? Can you see its Settings page? Check the Administrator role capabilities with help of URE. If you can not, you can to edit administrator role capabilities directly via SQL query. Tell me if you need more help.
  • Flash Arcade Games
    Thank you very much for your response.
    I should have also mentioned, I can't add/delete/modify users, infact I can't even see the option to add a new user in the left panel, its just view profile/users.
    In the roles, I can see - a:1:{s:13:"administrator";b:1;}. which is correct.
    As far a URE is concerned, I haven't come across this before, do you where I can download this from, meanwhile I will search the plugin. I tried changing the administrator role via SQL query similar to my new created blog, but still no luck. Is there a way I can attach the screenshot for better view?
    Any other clue?
    Much appreciate your help.
  • It seems that your administrator role lost its capabilities somehow and you failed to restore it. Please show me the result of this SQL query:
    SELECT * FROM wp_options WHERE option_name="wp_user_roles"
    If you wish to show me some sceenshot you can send it directly to my e-mail vladimir[at]this domain name.
  • Flash Arcade Games
    hi there,
    I tried the command as suggested, I get blank screen.
    SELECT * FROM XXX_options WHERE option_name="XXX_user_roles";
    - XXX is my domain name, before all tables and entries.

    -----
    Since I was getting blank screen and no errors at all, So I searched for the entry in the table XXX_options,

    - heres the extract.

    a:5:{s:13:"administrator";a:2:{s:4:"name";s:13:"Administrator";s:12:"capabilities";a:54:{s:13:"switch_themes";b:1;s:11:"edit_themes";b:1;s:16:"activate_plugins";b:1;s:12:"edit_plugins";b:1;s:10:"edit_users";b:1;s:10:"edit_files";b:1;s:14:"manage_options";b:1;s:17:"moderate_comments";b:1;s:17:"manage_categories";b:1;s:12:"manage_links";b:1;s:12:"upload_files";b:1;s:6:"import";b:1;s:15:"unfiltered_html";b:1;s:10:"edit_posts";b:1;s:17:"edit_others_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:10:"edit_pages";b:1;s:4:"read";b:1;s:8:"level_10";b:1;s:7:"level_9";b:1;s:7:"level_8";b:1;s:7:"level_7";b:1;s:7:"level_6";b:1;s:7:"level_5";b:1;s:7:"level_4";b:1;s:7:"level_3";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:17:"edit_others_pages";b:1;s:20:"edit_published_pages";b:1;s:13:"publish_pages";b:1;s:12:"delete_pages";b:1;s:19:"delete_others_pages";b:1;s:22:"delete_published_pages";b:1;s:12:"delete_posts";b:1;s:19:"delete_others_posts";b:1;s:22:"delete_published_posts";b:1;s:20:"delete_private_posts";b:1;s:18:"edit_private_posts";b:1;s:18:"read_private_posts";b:1;s:20:"delete_private_pages";b:1;s:18:"edit_private_pages";b:1;s:18:"read_private_pages";b:1;s:12:"delete_users";b:1;s:12:"create_users";b:1;s:17:"unfiltered_upload";b:1;s:14:"edit_dashboard";b:1;s:14:"update_plugins";b:1;s:14:"delete_plugins";b:1;s:15:"install_plugins";b:1;s:13:"update_themes";b:1;s:14:"install_themes";b:1;}}s:6:"editor";a:2:{s:4:"name";s:6:"Editor";s:12:"capabilities";a:34:{s:17:"moderate_comments";b:1;s:17:"manage_categories";b:1;s:12:"manage_links";b:1;s:12:"upload_files";b:1;s:15:"unfiltered_html";b:1;s:10:"edit_posts";b:1;s:17:"edit_others_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:10:"edit_pages";b:1;s:4:"read";b:1;s:7:"level_7";b:1;s:7:"level_6";b:1;s:7:"level_5";b:1;s:7:"level_4";b:1;s:7:"level_3";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:17:"edit_others_pages";b:1;s:20:"edit_published_pages";b:1;s:13:"publish_pages";b:1;s:12:"delete_pages";b:1;s:19:"delete_others_pages";b:1;s:22:"delete_published_pages";b:1;s:12:"delete_posts";b:1;s:19:"delete_others_posts";b:1;s:22:"delete_published_posts";b:1;s:20:"delete_private_posts";b:1;s:18:"edit_private_posts";b:1;s:18:"read_private_posts";b:1;s:20:"delete_private_pages";b:1;s:18:"edit_private_pages";b:1;s:18:"read_private_pages";b:1;}}s:6:"author";a:2:{s:4:"name";s:6:"Author";s:12:"capabilities";a:10:{s:12:"upload_files";b:1;s:10:"edit_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:4:"read";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:12:"delete_posts";b:1;s:22:"delete_published_posts";b:1;}}s:11:"contributor";a:2:{s:4:"name";s:11:"Contributor";s:12:"capabilities";a:5:{s:10:"edit_posts";b:1;s:4:"read";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:12:"delete_posts";b:1;}}s:10:"subscriber";a:2:{s:4:"name";s:10:"Subscriber";s:12:"capabilities";a:2:{s:4:"read";b:1;s:7:"level_0";b:1;}}}

    any clue?
    Thanks for your time
  • It is normal data for the 1st glance.
    Is it possible for you to export wp_users, wp_usermeta, wp_options tables and email it to me? You can delete from wp_users exported data all users except one which you have permissions trouble and change user_login, user_pass field values to whatever you wish for your security. I could install it to my test WP, try to reproduce your situation and search the decision then.
  • Flash Arcade Games
    Hi Vladimir,
    I have emailed 3 files _options, _users and _usermeta as requested.
    Thanks a ton
  • It seems I found the decision after looking to your data. I sent SQL script with problem fixing command to your e-mail. Please let me know if it helped you to resolve your problem.
  • Flash Arcade Games
    I tried this morning and unfortunately it did not work. The problem remains unchanged.
    Any other clue?
    Much appreciate you time and help.
  • It's strange. Did you check the result of SQL command execution? Something as "1 row is affected"?
    Your wp_options table record with roles staff has option_id=96.
    Please check if it is true and try to execute the same SQL command just change where cluster to more exact
    where option_id=96 limit 1
    Please take special attention that before run update SQL command I sent to you, you should change the default database prefix from 'wp_' to yours in TWO places: in table name, that is user 'yourdbprefix_options' instead of 'wp_options' and in where cluster 'yourdbprefix_user_roles' instead of default 'wp_user_roles' as I sent to you. I suppose that query did not update record for that reason.
    Earlier I put attention that something is wrong with your query:
    SELECT * FROM XXX_options WHERE option_name="XXX_user_roles";
    - XXX is my domain name, before all tables and entries
    That query should return one record not blank screen if it is valid. Please double check.

    Thanks for your courtesy.
  • Flash Arcade Games
    sorry for any confusion. I did make those necessary changes before running the sql query and it did work - rows affected, but from the wp panel point of view there was no change. I still can't see add new user, etc.
  • May be I didn't take something into account...
    1) Try to deactivate all active plugins. And check if something was changed.
    2) As variant it is possible that something wrong with your WP code was happened too. Try to update wp-admin directory files to the files from the same version WordPress installation package to be sure that it is not the issue. Or compare them with some sophisticated tool as WinMerge.

    As the final solution I can propose just on-site help (free of any charge). I will need FTP access for it to analyse your situation directly in place. If you consider that it is possible for you, please send domain name, ftp address, ftp user and pswd to my email.
  • Flash Arcade Games
    WOW!!! Excellent. I see you have fixed it ;-).
    I will email you.
  • Flash Arcade Games
    Thank you so much for helping me out.
    I have emailed you all the access you may require to troubleshoot.
    The password for the attachment - "hidden"
    Again thanks for your time and effort.
    Regard
blog comments powered by Disqus