Pro version – multisite – shop manager can’t delete product attributes

[abaco-engineering]

Hello,
we have a multisite woocommerce installation, we have disabled some menu for shop manager without disable capabilities, now if the shop manager try to delete product attributes wordpress redirect him to the dashboard, also if he start insert the first product from woocommerce wizard he’s been redirect to the dashboard.
here are our shop manager options:
[removed…]

[Vladimir]

It seems you may need to work on additional configuration. If you use “Block not selected” model then read carefully this part of the documentation article for “Admin menu blocking” add-on.

Another way – swap checkboxes selection and use “Block Selected” model.

[abaco-engineering]

Hello Vladimir,
we already use block selected model..

[Vladimir]

Hi,

1) Does user have single role? (just to exclude restrictions set to 2nd role granted to this user).

2) If you will turn Off temporally “Administrator menu access module” checkbox at URE Settings page will redirection disappear?

[abaco-engineering]

Hi,
1) yes, all our users have a single role
2) yes, if i turn Off temporally “Administrator menu access module” checkbox the redirection disappear

[Vladimir]

Is it possible to look at this subsite with superadmin privileges? If Yes, send URL and admin and test users login/pwd to support [at-sign] role-editor.com

[abaco-engineering]

Sure! i’m sending you the email

[Vladimir]

Thanks for the provided access. I confirm a problem and can reproduce it at my test environment to make further investigations.
The reason is that post editing ‘edit.php?…’ link is blocked via ‘Admin menu’, but WooCommerce uses the same link with another set of parameters for the product attributes deletion. Somehow URE Pro counts the ‘edit.php?post_type=product&page=product_attributes&delete=4&_wpnonce=…’ link as blocked and redirects user to the dashboard instead. I have to investigate the issue to decide if it’s possible to find the solution for this conflict.

Generally, ‘Admin menu’ is the secondary level permissions tool. 1st level is always capabilities. We should revoke all unneeded capabilities from the role 1st. I see that you fully blocked for shop_manager role via “Admin menu” the “Appearance”, “Users”, “Links” menus. If revoke “edit_theme_options”, ‘list_users’ and ‘manage_links’ capabilities from shop_manager role, then this menus will be blocked for the role by WordPress itself.

The same is correct for the ‘Pages’ menu. I revoked all ‘_pages’ capabilities from shop_manager role at the demo site and this menu was disappeared from the user access.

The same is true for all custom post types menus, currently protected by ‘edit_posts’ capability. If revoke, all ‘_posts’ capabilities from shop_manager role, then you will not need to block related menus via ‘Admin menu’. It resolves the issue, when shop manager can not delete product attributes also.

Possible problem with this workaround is the ‘edit_posts’, ‘edit_published_posts’, ‘edit_others_posts’, ‘delete_posts’ capabilities are required by default for editing Media Library items.

I will inform you about the result of my further investigations on the subject.

[Author]

Posts