Unable to Restrict Access within WP Admin on One Specific Site

[kdowdle]

Hello,

I use User Role Editor Pro to great effect on seven different WordPress sites. I have no problem restricting access to certain areas of the WP Admin by using the “Admin Menu” button of User Role Editor on most of those sites.

There is one site, however, on which this functionality does not work. I’m not able to restrict access to any items of the WP Admin by using the “Admin Menu” feature on this site: moneymorning.com

Can you please help me troublshoot this issue? I can provide screenshots of the User Role editor settings.

Thanks,

Kevin

[Vladimir]

Hi Kevin,

Re-check that test user really have role, for which you set “Admin Menu” restrictions. Try to re-assign that role to him (remove role, update profile, assign role back).
Check if you use some plugin with admin menu editing functionality, try to deactivate it, to understand if there is any conflicts between plugins.
Yes, show screenshots with ‘Admin menu’ window and what menu items are not blocked.

[kdowdle]

Hi Vladimir,

Thank you so much for the quick response and for the suggestions!

The role in question is called “Production”. Here’s a screenshot of the “Admin Menu” window for the Production role: http://i.imgur.com/4WZWr72.png

As you can see, the “Market News” and “Links” items should be blocked for this role. Here’s a screenshot of a user with the Production role, where you can see that they still have access to both of those items: http://i.imgur.com/5LLWZ1u.png

So I just took the following steps:
1. Change role of test user account from Production to Administrator
2. Change role of test user account back to Production

And this user still has access to those two items while assigned to the Production role.

I’ll investigate whether there is a plugin on the site that may be interfering. In the meantime do you have any other thoughts?

Thanks,

Kevin

[Vladimir]

Hi Kevin,

What version of User Role Editor Pro is installed at your site?

[kdowdle]

Hi Vladimir,

I updated to the latest version (4.24.6) earlier this week. This problem existed before I made that update as well.

Thanks,

Kevin

[Vladimir]

General recommendation – whenever it’s possible to block access via user capability – remove that capability from the user role. Use ‘Admin menu access’ module just in case you have to leave the capability in the role to provide access to some other menu items.

Links menu is protected by ‘manage_links’ capability. I suppose it is not used anywhere else. So remove it from the ‘production’ role.

Btw, I successfully blocked ‘Links’ menu as ‘Not Selected’ at recent test with URE Pro v. 4.24.6. It just confirms your guess that discussed site has something special…

[kdowdle]

Thank you for the suggestion! I just updated the manage_links capability for this role and it is being successfully hidden now.

I’ll continue to deactivate plugins on my dev site to see if one of them is the culprit. I’ll let you know if I find anything.

Thanks again for all of the help!

Kevin

[Richard Moore]

In case anyone is having the same problem. I have found a conflict between Admin Menu Editor and the Admin Menu button functionality.

Changes to wp admin menus were not “sticking”. De-activated the menu editor plugin I was already using and it worked fine.

[Vladimir]

“Admin Menu Editor” plays on the same field as the User Role Editor Pro “Admin menu access” add-on. They try to modify the same menu data structure simultaneously. So the conflict is very expected. In case you need extended menu modification functionality offered by Admin Menu Editor look at the Admin Menu Editor Pro and do not use “Admin menu access” add-on from URE. Admin Menu Editor Pro allows to assign to menu items custom user capabilities so there will be no need to block them, just add/revoke those capabilities to/from the roles.

[kdowdle]

Hi Vladimir,

We’ve managed to narrow down the plugin causing the problem: W3 Total Cache. When deactivated on our staging site, the Production role has the correct areas restricted. However, we use W3TC extensively across our site. Are you aware of any conflicts between the two plugins, or would you have a recommendation for the best course of action to resolve it? I can provide screenshots if necessary.

Thanks again for helping out with this!

[Vladimir]

Hi Kevin,

There was one message from a client about conflict with W3 Total Cache some time ago. He planned to switch to another caching plugin.

I do not have a quick decision on hands. This issue requires the special investigation.
Did you tried to clear the cache at W3TC after updating admin menu settings in User Role Editor?

[kdowdle]

Hi Vladimir,

Clearing the cache with W3TC did not resolve the issue. The areas we want restricted remained available to that particular role. This is consistent across staging environments.

[Vladimir]

Hi Kevin,

I make my own test with active W3TC and can not repeat the issue. If you use CDN, cached version of the page may be provided from there and it could be built for other user.
May be it has sense to use one of these W3TC options:
– Don’t cache pages for logged in users;
– Don’t cache pages for following user roles;
available at the “Page Cache -> General” section?

[kdowdle]

Hi Vladimir,

I have an update and a solution here!

I’ve discovered that the issue was related to one of the settings in W3TC under General Settings. We had set up the “Monitoring” setting in W3TC so that we could see data in New Relic (a third-party monitoring service).

As soon as I disabled this, the URE admin menu settings started to work! Admin menu items are being hidden/shown as expected.

For anyone else that runs into this conflict: just disable the monitoring setting under W3TC “General Settings”!

Thanks,

Kevin

[Vladimir]

Hi Kevin,

Thanks for sharing this information.

[Author]

Posts