Admin menu editor not working at all

[webyours]

I bought the Unlimited Pro version and unfortunately the first thing I try to do is already not working.

I am using the admin menu editor and blocked a couple of menu items for a specific role. Testing it with said role, I noticed no change. Resaved, testet again, not working. I completely deleted the role, set it up again, set up the menu restrictions, not working. There are no errors.

Any help would be greatly appreciated.

[Vladimir]

Send the screenshots of settings in “Admin menu” you made for a role and what menu a user with that role really sees at /wp-admin.
What plugin registered menu items, which you can not block?

[webyours]

Ok, I narrowed it down. I am using the Beaver Builder plugin, and if its activated, its not possible to block any admin menu items (WordPress core as well as plugin registered ones).

There seems to be a plugin conflict. I am reporting this to the BB team as well.

[Vladimir]

I tested the Beaver Builder Lite version available at wordpress.org and can not repeat an issue. I suppose that you use the Pro version. Can you share BB Pro plugin copy (via DropBox or similar service) – support [at-sign] role-editor.com? I would try to repeat the issue and isolate a reason then. I setup such copies locally and use for testing/investigation only.

[ueberzeugungsarbeit]

I have the same problem – beaver builder pro seems to disable the menu editor. If I deactivate beaver builder pro, it works!

[Vladimir]

Can you share Beaver Builder Pro copy for testing?

[Vladimir]

I got a copy of Beaver Builder Pro plugin version 2.1.2.4 for testing from one of the clients. The result of my investigation below:

User Role Editor (URE) does not limit superadmin – for WordPress single site URE counts as a superadmin any user with ‘administrator’ role and uses WordPress’s own is_super_admin() function for the multisite installation only. URE is written this way as WordPress counts as a superadmin for single site installation any user with ‘delete_users’ capability. Such user is not a real superadmin for many cases with multiple users who can edit users only with limited roles available for the selection.

Beaver Builder (BB) plugin developers counts that they may work with user permissions very-very freely. If WordPress counts someone as a superadmin, but he does not have ‘administrator’ role for some reason. let’s grant this role to him. Why not?

Thus, even if you did not plan to grant to someone the ‘administrator’ role, just allow him to delete users, BB plugin will make it for you very freely and easily.
My conclusion – it’s incorrect way of working with user permissions.

In theory BB should grant not ‘administrator’ role, but the full list of BB capabilities only and not directly to a current user, but to ‘administrator’ role only. Some subset may be granted to editor role, etc. Leave the decision what user what permission has at the site to the site administrator, do not decide so critical question for him behind the scene.

Workaround: comment lines 255, 256, 257 at bb-plugin/classes/class-fl-builder-user-access.php file and do not forget to repeat that after every BB plugin update until they update this part of code with something more compatible with security requirements.

[Jacob Hill]

I’m glad that I found this thread! I’m not sure if this information made it to the Beaver Builder team, but I have submitted a ticket to them referencing this thread. I’ll let you know if they are able to fix this.

Jake

[Vladimir]

Jake,

Thanks for this and upcoming information. The author of this topic have made the same and did not get response from BB developers yet.

[Jacob Hill]

Hello Everyone!

I received a response from the Beaver Builder team:

We’ve had similar reports from other customers so we have been looking at the best way to approach this to avoid issues. We haven’t come up with a stable solution yet – we’re still testing the best approach.

Hopefully we’ll get some good news soon!

Jake

[Vladimir]

Hi Jake!

Good news that they work on a problem. Let’s wait for the update.

[Jacob Hill]

Hey Everyone!

It appears that the Beaver Builder team may have fixed this issue. The change log for v2.1.5 has the following entry:

Changed delete_users capability to manage_options for builder UI and added fl_builder_admin_settings_capability filter.

I’ve emailed them to confirm that this change is geared towards this fix. They confirmed that this should fix it!

Jake

[Vladimir]

Hi Jake,

Thanks for this update. It would be good to know the results of your tests.

[Jacob Hill]

They confirmed that the new update should fix it!

[Vladimir]

Excellent!

[Author]

Posts