User Role Editor WordPress plugin

User Role Editor WordPress plugin

User Role Editor

User Role Editor WordPress plugin allows you to change standard WordPress user roles capabilities with easiness of a few mouse clicks. Just turn on check boxes of capabilities you wish to add to the selected role and click “Update” button to save your changes. That’s done. Add and tune your own custom roles which you can assign to the users then. You can create new role as a copy of existing one. Delete self-made roles. Change defaul user role.
Multi-site support is provided.
Why it could be necessary? Let’s suppose you wish that your multi-authored blog contributors upload their own graphics to use in their posts. WordPress “contributor” role has no such capability by default. In such situation you have needed to change user role capabilities manually using SQL client as I described at “How to change wordpress user role capabilities” post, if you have enough knowledge in that field. But what to do if you have not? Good news – This task is simple now, just use the “User Role Editor” plugin :) .

Version 3.5 is available. Click the Download button below if you wish to try it.
download

Take a look at the “User Role Editor” plugin main form screenshot:
User Role Editor main form

  • Select a role you wish to change from the drop down list at the top. Page will be refreshed automatically and show you the capabilities list for the selected role. Make your corrections, check/uncheck correspondent check boxes and click “Update” button to save your changes. If you wish to apply this change for all sites of your multi-site WordPress network, turn on “Apply to All Sites” check box at the top of the form.
  • If you prefer to see capabilities names in form e.g. ‘Edit pages’ instead of WordPress ‘edit_pages’ standard form turn on the “Show capabilities in human readable form” checkbox at the right top corner of the main form. Move mouse over capability name and you will see its alternative form name.
  • According to WordPress Codex User Levels were introduced in WordPress 1.5, they were replaced by Roles and Capabilities in WordPress 2.0, and were finaly deprecated in WordPress 3.0. Thus you can hide them in order they do not mess you in your work with roles. Keep “Show deprecated capabilities” check box at the to right corner of the form unchecked for that. If for any reason you need to see user levels, turn on that check box.
  • If you don’t wish to save changes you can click “Cancel” button.
  • If you are needed to restore roles capabilities you have before 1st visit “User Role Editor” main form, use “Reset” button.
    When you you open this form 1st time, plugin checks if backup copy of roles and capabilities exists. If it doesn’t, plugin creates backup copy automatically. Thus, when you some day click the Reset button plugin uses the previously saved role data backup copy to restore it. Be very careful with this operation as you will definitely lose any changes you or your plugins made to user roles from that time.

In order to add/remove your custom role, change default role for new user, add/remove custom user capability use “User Role Editor” management boxes, look on screenshot below:
User Role Editor custom roles and capabilities management boxes

  • If you need your own custom role, create it with “Add New Role” feature. Input new role name into input text field at “Add New Role” box, select existing role from drop-down list if you wish to use its capabilities as starting point for further work and click “Add” button. Remember that you can use latin letters, digits and an “_” underscore sign in your role names. Subscriber role is copied by default if you don’t select such role yourself.
  • Unnecessary self-made role can be deleted with “Delete Role” box. Select role and click “Delete” button for it. Only your self-made roles appears in the role list to delete. If some of your own roles is assigne to the user or selected as default role for new users it will not be appeared in the list for deletion.
  • Select the role which you wish to use as default for any new created user from the list at “Default Role for New User” box. Click “Change” button to save your changes.
  • Use “Add New Capability” box in order to add new user capability. Remember you can use only latin alphabet letters, digits and underscore sign in the capability name. How to use new added user capability? Turn it on in the role you select and check if current user has such capability in your plugin or active theme functions.php file. For example,
     if (!current_user_can('some_capability_you_added')) {
       echo "You don't have permission for it!";
       return;
    }
  • If you need delete custom capability added by you or some of your old plugins, which you don’t use anymore use “Delete Capability” box. “User Role Editor” doesn’t allow to delete built-in WordPress capabilities.

With help of “User Role Editor” you can assign additional capabilities directly to the users. Open users list by click on the “All Users” link at the “Users” submenu. Find needed user, move mouse pointer to his name and click “Capabilities” link as on screenshot below:
User Capabilities Editor link
At the form opened you can assign to user another role and/or add to him capabilities which not included to his role:
Change User Capabilities
You can not turn off capabilities included to the role assigned to this user. You can add/remove other capabilities. They will be applied directly to the user as you click the “Update” button. If you wish to built a fully custom capabilities set for this user, without limitation of any role, select “No role for this site” from drop-down list at the top and make it.

For more information about WordPress user roles please read these articles
- WordPress Admin Menu Permissions;
- WordPress user capabilities;
- activate_plugins WordPress user capability;
- edit_dashboard WordPress user capability;
- Delete posts and pages WordPress user capabilities set;
- moderate_comments WordPress user capability;
- Roles and Capabilities article at codex.wordpress.org;

Translations

Русская версия этой статьи доступна по адресу ru.shinephp.com

All other translations listed below are outdated and need to be updated. It’s very simple to get link to your site from this page – just update your native language translation file and send it to me. You are welcome!

Dear plugin User,
if you wish to help me with this plugin translation I very appreciate it. Please contact me via Contact form and I will answer you by email. Do not forget include your site link in order I can show it with greetings for the translation help at shinephp.com, plugin settings page and in this readme.txt file. If you have better translation for some phrases send it to me. You are welcome!
Former translators! Please check your translations and provide the updated files corresponding to the current version of URE plugin.

Special Thanks to

  • Lorenzo Nicoletti – for the code enhancement suggestion CUSTOM_USER_META_TABLE constant is used now for more compatibility with core WordPress API.
  • Marcin – For the code enhancement. This contribution allows to not lose new custom capability if it is added to other than ‘Administrator’ role.
  • FullThrottle – for the code to hide administrator role at admin backend.

You are welcome! Help me with bugs catching, share with me new ideas about plugin further development and link to your site will appear above.

People who donated for this plugin developement

Change Log

  • 3.5 = 19.02.2012
    - User Role Editor could be available now for single site administrators (Administrator role) under multi-site environment. You should define URE_ENABLE_SIMPLE_ADMIN_FOR_MULTISITE constant in your blog wp-config.php file for that. Insert this line

     define('URE_ENABLE_SIMPLE_ADMIN_FOR_MULTISITE', 1);

    there, if you decide to give single site admin such opportunity.
    - One of “User Role Editor” users with 1100+ sites in the multi-site network reported that URE doesn’t update roles for all sites, but stalls somewhere in the middle. Other network update method is realized as alternative. Due to my tests it works approximately 30 times faster. If you met the same problem, try it. It will be great if you share your experience with me. In order select alternative method of all sites update add this line to you blog wp-config.php file

     define('URE_MULTISITE_DIRECT_UPDATE', 1);

    But be careful. It’s recommended to make 1st try on the backup copy, not on a live site.
    - Persian translation is updated. Thanks to Parsa.

  • 3.4 = 21.01.2012
    - You can see/edit “Administrator” role now. Insert this line of code

      define('URE_SHOW_ADMIN_ROLE', 1);

    into your wp-config.php file and login with administrator account for that.
    If for any reason your Administrator role missed some capabilities added by plugins or themes, you can fix that now. But be careful with changing “Administrator” role, do not turn off accidentally some critical capabilities to not block your admin users.

  • 3.3.3 = 11.01.2012
    - Spanish (Dario) and Swedish (Andréas) translations update.
  • 3.3.2 = 02.01.2012
    - Enhance server side validation for user input of new role name, minor bug fixes.
  • 3.3.1 = 12.12.2011
    - Compatibility with Internet Explorer fix: It automatically replaced ‘&copy’ in ‘&copy_from_user_role’ URL parameter inside JavaScript code to copyright sign.So I should use other name for this parameter. Thanks to Michael Wiekenberg for the help with isolating this issue.
  • 3.3 = 10.12.2011
    - New role can be created as a copy of other existing one.
    - You can hide/show deprecated capabilties (level_1 – level_10).
    - Users with “Administrator” role are not shown to other users with “list_users” capability.
    - Plugin data cleanup is added – plugin options will be automatically deleted if you delete plugin via WordPress link.
    - Some code enhancements are applied, e.g. optimization and using of WordPress API instead of self-written routine.
  • 3.2.1 = 01.08.2011
    - This is a bug-fix update. If you didn’t met this bug you can skip this update. “usermeta” table doesn’t exist bug appearing on some multi-site blogs is fixed. Read [this post](http://wordpress.org/support/topic/multisite-setup-gives-usermeta-table-error) for more information. Thanks to harpinder for discovering this bug and for the help with testing updated code. “usermeta” Db table name is define by more universal way now.
  • 3.2 = 25.07.2011
    - If you run multi-site WordPress network, User Role Editor will automatically duplicate all roles from the main blog (blog with mininal ID) to every new created blog.
    - Some fixes, refactoring and logic change were applied to code to enhance its productivity. There were some complaints for PHP timeout error after trying to open plugin Settings page.
    - Thanks to Grant Norwood for code fix to hide PHP warnings he met during plugin usage.
    - Hebrew translation is added. Thanks to Sagive.
    - French translation is updated. Thanks to Whiler.
    - Japan translation is updated. Thanks to Kaz.
    - Spanish translation is updated. Thanks to Dario.
  • 3.1.1 = 07.07.2011
    - CUSTOM_USER_META_TABLE constant is used now for more compatibility with core WordPress API. Thanks to Lorenzo Nicoletti.
    - Turkish translation is updated. Thanks to Muhammed YILDIRIM. Other language translators are welcome!
  • 3.1 = 03.06.2011
    - Add/Remove capability boxes are added to the User Role Editor
    - Capabilities could be assigned directly to the user, additionally to the assigned role
    - PHP4 is not supported by this plugin anymore. Update your site to PHP5 in order to use this plugin and near to release WordPress 3.2 :)
    - Minor compatibility issues with other plugins were fixed

Click here to get full list of User Role Editor updates.

FAQ

- Does it work in multi-site environment?
Yes, it works with multi-site installation. By default plugin works for every blog from your multi-site network as for locally installed blog without multi-site feature.

URE Multi-site feature

URE Multi-site feature


To update selected role globally for all Network you should turn on the “Apply to All Sites” checkbox.

- How to duplicate my custom created roles from main blog of my multi-site network to new created one?
“User Role Editor” makes it for you automatically. As new blog added to your network, “User Role Editor” copies full roles staff from your main blog to the new created one.

- Why administrators of single site of multi-site network do not see “User Role Editor” under “Users” menu?
URE is disabled for single site administrator by default. If you wish to enable it for single site adminitstrator add this line of code into your blog wp-config.php file

define('URE_ENABLE_SIMPLE_ADMIN_FOR_MULTISITE', 1);

- I have large multi-site network. After click “Update” button with “Save to all sites” checkbox turned on nothing is happened. I got the blank page.
It is PHP script execution time limit problem. Other network update method is available as alternative from version 3.5. Due to my tests it works approximately 30 times faster. Try it. It will be great, if you share your experience with me. In order select alternative method of all sites update add this line to you blog wp-config.php file

define('URE_MULTISITE_DIRECT_UPDATE', 1);

It shows execution time in milliseconds if you define WP_DEBUG equal to 1 or true constant in wp-config.php file.

- How to edit “Administrator” role? I don’t see it in the roles drop down list.
“Administrator” role is hidden from the roles drop down list by default.
You can see/edit “Administrator” role starting from version 3.4. Insert this line of code

  define('URE_SHOW_ADMIN_ROLE', 1);

into your wp-config.php file and login with administrator account for that.
If for any reason your “Administrator” role missed some capabilities added by plugins or themes, you can fix that now. But be careful with changing “Administrator” role, do not turn off accidentally some critical capabilities to not block your admin users.

- Does it work with WordPress versions prior 3.0?
Starting from version 2.2 plugin works with WordPress 3.0 and higher only. For earlier WordPress versions use plugin version 2.1.10

download

I am ready to answer on your questions about this plugin usage and help with possible problems. Use User Role Editor plugin forum or this page comments and site contact form for that please.

Thanks,
Vladimir ShinePHP.com

The testking offers guaranteed testking VCP-410 training with best quality testking 350-001 braindumps and testking 70-680 practice exam.

Tags: WordPress, wordpress plugin

  • Sean Norton

    Hi, is there a way for me to allow a user to edit a published page without allowing them to publish the changes until the edits have been reviewed?

  • http://shinephp.com Vladimir Garagulya

    Find that user in the user list and look for the “Capabilities” link under his name. You can add new capabilities directly to this user their.

  • http://shinephp.com Vladimir Garagulya

    Look this short video, it should help:
    http://youtu.be/ytEldoENpdM

  • Sean Norton

    Thanks, Vladimir. Which file should I add this function to?

  • http://shinephp.com Vladimir Garagulya

    Put that code into your theme functions.php file.

  • http://shinephp.com Vladimir Garagulya

    No problem :) , you are welcome.

  • Sean Norton

    That doesn’t seem to have worked. I edited the theme functions.php by adding

    function published_to_pending($post_id) {
    global $post;
    if(current_user_can('author') && $post->post_status=='publish'){
    remove_action('save_post','published_to_pending');
    //update the post, which calls save post again
    wp_update_post(array('ID'=> $post_id, 'post_status' =>'pending'));
    //re-hook this function   add_action('save_post','published_to_pending');
    }
    }
    
    add_action('save_post','published_to_pending');

    and cleared my cache, etc… the only thing that it appears to have done is remove the ‘Published on’ information. I made an edit to the page with a test account that does not have publish_page capability and was still able to make changes to the page and publish.

  • http://shinephp.com Vladimir Garagulya

    Please check last line inside function, is add_action() placed on the commented line? It should be placed on the new line without comment // sign.

  • http://shinephp.com Vladimir Garagulya

  • Sean Norton

    Strange… there must be something prohibiting this from working. I’ve added the above code to my functions.php file for the theme and the only change that takes place in the page editor is that the “Published On” Information has been removed. My user has the following capabilities:

    delete_posts, edit_others_pages, edit_others_posts, edit_pages, edit_posts, edit_published_pages, read, upload_files
    
  • http://shinephp.com Vladimir Garagulya

    Please confirm or reject my guess:
    Code above work for the users with ‘author’ role only. Do you remember
    if (current_user_can('author') ... ?
    Has user, which you try, the ‘author’ role or may be someone with other name?

  • Sean Norton

    Ah, you’re right: I had created a custom user role based on Author but named something else. That fixed the “Submit for Review” issue and is now working as you demonstrated.

    However, even though the page is now in a “Pending” state, the changes are still getting published to the live page.

    Your assistance and patience are much appreciated, Vladimir.

  • http://shinephp.com Vladimir Garagulya

    You are welcome. About changes showing to the live page. As it could be useful for other WordPress users, I published this post with workaround for this issue:
    http://www.shinephp.com/wordpress-shows-unpublished-pages/

  • Anonymous

    Hello Vladimir. Again thank you for this plugin and for for adding the multi-site feature. Now that I am using WordPress 3.3, when trying to apply to all sites, it does finish all the way through. Have you come across this yet? If so, is there a fix? Thanks.

  • http://shinephp.com Vladimir Garagulya

    Hello,

    No, it is a first note about trouble with multi-site support for WP 3.3. Can you give me more details about what is going wrong?

    Regards,
    Vladimir.

  • Anonymous

    I created a screencast to better show what is happening. After it finishes, it comes back with a white area instead of showing the form again. Also, I should note that there are over 1100 blogs on this site: http://www.screencast-o-matic.com/watch/clnn2n4Vo

  • http://shinephp.com Vladimir Garagulya

    The last info about 1100 blogs in one network is critical. It seems that you just met PHP script execution timeout, that’s why you got empty page, and role change is applied to not all sites of course. There is not update for this problem for this moment.
    Thanks for the information about using URE plugin in so large environment.
    I will think, how to overcome this problem and publish update as it will be ready.

  • http://www.boardirectory.org/ Board Directory

    Hello,

    I love this plugin and been using it for sometime now, I hope you continue to work on it!

  • http://shinephp.com Vladimir Garagulya

    Hello,
    I confirm your hope. I will continue this work, and I’m open for suggestions how to enhance User Role Editor.

  • Francois

    Hello everyone,

    Great Job with  this plugin.

    Does anyone know a simple solution to manage the visibility of a plugin settings tab which has no custom capability coded ? I would like to keep using “User role editor” and not to switch to another plugin though.
    To be more precise, i need to show a plugin options tab while denying “manage-options” capability to a custom role. Which is the capability that seems to be driving the tab visibility …

    Any idea ? Thanks

  • Jeff

    Wow.  Combined with the BuddyPress Restrict Group Creation plugin (http://wordpress.org/extend/plugins/buddypress-restrict-group-creation/), this was exactly what I needed to allow only a specific s2Member level to have the ability to create BuddyPress Groups on a WordPress 3.3.1 and BuddyPress 1.5.3.1 installation.  Thanks!

  • http://shinephp.com Vladimir Garagulya

    Hello,
    Generally it’s impossible without modification of plugin code. In most cases main plugin file (it probably has the same name as plugin) contains function call, which creates its settings page or submenu, e.g.:
    add_options_page('Thank You Counter Button Settings', 'Thanks CB', 'edit_users', $base_name, 'thanks_options');    
    or
    add_submenu_page('users.php', __('User Role Editor'), __('User Role Editor'), 'edit_users', basename(__FILE__), 'ure_optionsPage');
    or
    add_menu_page('Some Plugin', 'Some Plugin', 'edit_users', 'some_plugin', 'options');

    In all examples above ‘edit_users’ is key capability, which manages user access to plugin menu. If plugin has separate submenu, you can change that capability to your custom created one editing plugin source code and you task is resolved. If plugin just added its menu item or submenu to the WordPress Settings or other submenu, your role should have capability which defines access to that submenu also. Thus, if you remove ‘manage_options’ capability from your role, the whole ‘Settings’ submenu will disappear from that user.

  • http://shinephp.com Vladimir Garagulya

    Hello Rod,

    I’m sure all users at multi-site environment have the similar situation. It’s not a bug it’s a feature. I make it to stay together with WordPress, which allows to edit user and change his role just for superadmin only.
    Thanks for showing me place where I should enhance URE interface, – hide ‘Settings’ link on the Plugins page if user is not superadmin.

    It will be better, possibly, to add special capability for URE itself, and let superadmin manage himself, whom he allows to use User Role Editor.
    What do you think?

  • Rod Potter

    Thanks for replying so quickly. That sounds like a great feature to me. You would want to hide the “Apply to All Sites” checkbox from regular site admins, I guess. As it is now, non-superadmins should not be able to activate the plugin since they can’t use it.

    Would it be easier to just allow regular admins to activate and use safe URE functions for their own site? Or are there other security implications?

  • http://shinephp.com Vladimir Garagulya

    Thanks. That’s really shoud be fixed.

    Regular admin or single site admin can select other role for user of his site. Why do not allow him to create new or edit existing roles of his site only?
    I don’t see the reason why I should prohibit it.
    I think, I will add this feature. But it will not be active by default. Site admin should activate it himself (if needed) placing special constant into wp-config.php
    What do you think? Is it suitable for you?

  • Francois

     Thanks Vladimir ! Very clear answer. I will try this, since the plugin has his separate sub-menu in Wp admin.

  • Rod Potter

    Hi Vladimir — your idea to make this feature settable in wp-config is perfect. It would definitely work on our site and I’m sure it would be useful for a lot of multi-site installs.

  • http://twitter.com/OxideTones OxideTones

    Hi there,

    I need to add the capability to add/edit/remove tags to a specific role, however I can’t work out how to. I created new capabilities (edit_tags. manage_tags and edit_other_tags) and added these to the role, however the tag area doesnt appear for those users with the role.

    Is there something Im missing?

    Thanks, Adam

  • http://twitter.com/OxideTones OxideTones

    never mind, solved it… the capability needed is “manage_categories ”

  • http://www.jeubfamily.com Chris Jeub

    Vladimir, I enjoy your plugin. Thank you so much for it. I’m having trouble limiting post categories to specific users. For example, I’d like a user role to ONLY post to a certain category (not able to post to other categories). Is this possible with User Role Editor?

  • http://shinephp.com Vladimir Garagulya

    Hello Chris,

    I made special post to help you and possibly other readers to limit post categories for specific role.
    Please look at
    http://www.shinephp.com/block-posting-to-selected-categories/

  • http://shinephp.com Vladimir Garagulya

     Please try version 3.5 with additional configuration parameter (look inot FAQ or changelog) and let me know, how it works for you.

  • http://shinephp.com Vladimir Garagulya

    Please try version 3.5 with alternative method for multi-site network update. Look into FAQ or ChangeLog for version 3.5 to know how to configure it. It would be great to know, if it will help you or not.

  • meanbiz

    Hello Vladimir,
    I found URE after long way to search a right plugin for my site. I believe it would meet all my needs and am grateful for you.

    What I need for my site is to let a new role(I named it as ‘writer’) to publish posts ONLY while all other capabilities are hidden to it. However, there is a ‘portfolio’ menu in my theme and as I turned on ‘edit_posts’ capability at the setting, ‘portfolios’ menu appears on dash board as well as ‘writing posts’ menu. And as I turn off ‘edit_posts’ capability, even if ‘publish_posts’ capability is still remained on, both of ‘portfolios’ and ‘writing posts’ menu at dash board get disappeared.
    I was wondering how if I could separate posts and portfolio and let only posts appeares at dash board for a specified role.

    Thank you in advance.

    Best regards,
    Eugene