Why URE restricted role when it is clearly given permission (on Submenu)?

[James Wee]

Settings
Role: faculty_manager
Username: facultyadmin
Post Types: Faculty, News, Events
Permission Capability: create_news, edit_news, create_events, edit_news, create_faculty, edit_faculty (and all other capabilities)
User Editor Restriction: ID(1601), points to a post in faculty
Submenu Setup: (See code at bottom)

I want the user (facultyadmin) to be able to
1. Create all News
2. Create all Events
3. Edit only Post ID: 1601 (in faculty)

Issue:
With this setup, URE restricted “create_news” and “create_events”. I don’t know why. When I go to the “News” submenu and press “Add New”, an error appears that says:

You do not have sufficient permissions to access this page.

Unless I add the following code to the submenu array.

array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'Add News',
      'menu_title'    => 'Add News',
      'capability'    => 'create_Newss',
      'menu_slug'     => 'post-new.php?post_type=news',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
    array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'Add Events',
      'menu_title'    => 'Add Events',
      'capability'    => 'create_Eventss',
      'menu_slug'     => 'post-new.php?post_type=events',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),

This would make my submenu to show like this:

News & Events
  > All News
  > All Events
  > Add News
  > Add Events

Ideally I would love to show only the following and allow users to add the “Add New” button in the news and events pages respectively

News & Events
  > All News
  > All Events

Is this a bug or there’s a way around this?

Submenu Setup

function menu_news_and_events() {

  $page_title = "News & Events";
  $menu_title = "News & Events";
  $capability = "create_Newss";
  $menu_slug  = "edit.php?post_type=news";
  $function   = "";
  $icon_url   = 'dashicons-feedback';
  $position   = 178;

  //Add Parent Menus
  add_menu_page($page_title, $menu_title, $capability, $menu_slug, $function, $icon_url, $position);

  $submenu_pages = array(
    array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'All News',
      'menu_title'    => 'All News',
      'capability'    => 'edit_Newss',
      'menu_slug'     => 'edit.php?post_type=news',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
    array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'All Events',
      'menu_title'    => 'All Events',
      'capability'    => 'edit_Eventss',
      'menu_slug'     => 'edit.php?post_type=events',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
  );

  // Add each submenu item to custom admin menu.
  foreach($submenu_pages as $submenu){
    add_submenu_page(
      $submenu['parent_slug'],
      $submenu['page_title'],
      $submenu['menu_title'],
      $submenu['capability'],
      $submenu['menu_slug'],
      $submenu['function']
    );
  }
}
add_action('admin_menu', 'menu_news_and_events');

ALL POST TYPE RESTRICTIONS HAVE BEEN GRANTED USING THE FILTER

/*
* Filter URE Restrict Edit Post Type
* Docs: https://www.role-editor.com/documentation/hooks/ure_restrict_edit_post_type/
*/
add_filter('ure_restrict_edit_post_type', 'exclude_posts_from_edit_restrictions');
function exclude_posts_from_edit_restrictions($post_type) {
  $restrict_it = true;  
  if (current_user_can('faculty_manager')) {
      if ($post_type == 'news' || $post_type == 'events' ) {
          $restrict_it = false;
      }
  }
  return $restrict_it;
}

[Vladimir]

I suppose that the 1st thing you need to re-check is the custom post type capabilities:
How did you define ‘news’ custom post type capabilities?

Generally if you define ‘video’ custom post type for example, capabilities will be ‘create_videos’, ‘edit_videos’.
What will be for ‘news’ custom post type. Are there ‘create_newss’, ‘edit_newss’?
Then ‘create_news’ in a role will not work as ‘create_newss’ will be required.

2nd, did you set any restrictions with “Admin Menu Access” add-on for this role?

[James Wee]

Yes, it’s a typo on my part. Role Editor Plugin automatically adds an “s” to the back of all capabilities. (LOL)

1. To rephrase, the custom post type capabilities are
– create_Newss, edit_Newss and all other prefixes (delete, publish, read)
– create_Eventss, edit_Eventss and all other prefixes (delete, publish, read)

2. Nope, Admin Menu Access is not activated.

I have sort of created my outcome by doing the following code below (setting “parent_slug” to null).
This hides the “Add News” and “Add Events” buttons while giving the user the capability to create_Newss and create_Eventss. I don’t understand why, but if I don’t add the 2 buttons below, the user does not have permission to do create_Newss and create_Eventss.

    array(
      'parent_slug'   => 'null', //Don't display on menu
      'page_title'    => 'Add News',
      'menu_title'    => 'Add News',
      'capability'    => 'create_Newss',
      'menu_slug'     => 'post-new.php?post_type=news',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
    array(
      'parent_slug'   => 'null', //Don't display on menu
      'page_title'    => 'Add Events',
      'menu_title'    => 'Add Events',
      'capability'    => 'create_Eventss',
      'menu_slug'     => 'post-new.php?post_type=events',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),

[Vladimir]

That’s good that you found a workaround.
I did not make any tests myself yet. So, just my assumptions:
Did you define custom post type with 1st uppercase letter, like ‘News’ instead of ‘news’?
Some mess may take place with capability ID: ‘create_newss’ vs ‘create_Newss’. Last one could be not converted or converted to the lowercase somewhere.

[James Wee]

Oh damn, I did! I set the “Capability Type” in CPTUI with camelcase. Changing it now.

BTW. Is it a WordPress requirement for have both the capabilities below in order for View and Create to work?
edit_posttypename (edit.php)
create_posttypename (post-new.php)

Because I just created a new submenu called Programmes with Foundation, Diploma, Degree, Postgrad and it just kinda bugs me to create 4 edit.php and hide 4 post-new.php

[Vladimir]

WordPress uses just ‘edit_{post_type_name}’ by default. ‘create_{post_type_name}’ is added as additional restriction when you activate “edit restrictions” add-on at User Role Editor Pro settings. So restricted user without ‘create_’ capability can not add new posts.

[James Wee]

Yes, but I have granted all privilege (including create_{posttype} ) for the post type “news” and “events”.

And with this submenu setup alone it will not allow me to create news and events.

 $submenu_pages = array(
    array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'All News',
      'menu_title'    => 'All News',
      'capability'    => 'edit_newss',
      'menu_slug'     => 'edit.php?post_type=news',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
    array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'All Events',
      'menu_title'    => 'All Events',
      'capability'    => 'edit_eventss',
      'menu_slug'     => 'edit.php?post_type=events',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
  )

I have to do something like this in order to enable create_{posttype} for the users. Why is that so?

  $submenu_pages = array(
    //edit.php 
    array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'All News',
      'menu_title'    => 'All News',
      'capability'    => 'edit_newss',
      'menu_slug'     => 'edit.php?post_type=news',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
    array(
      'parent_slug'   => 'edit.php?post_type=news',
      'page_title'    => 'All Events',
      'menu_title'    => 'All Events',
      'capability'    => 'edit_eventss',
      'menu_slug'     => 'edit.php?post_type=events',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
    //post-new.php HIDDEN
    array(
      'parent_slug'   => 'null', //Don't display on menu
      'page_title'    => 'Add News',
      'menu_title'    => 'Add News',
      'capability'    => 'create_newss',
      'menu_slug'     => 'post-new.php?post_type=news',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
    array(
      'parent_slug'   => 'null', //Don't display on menu
      'page_title'    => 'Add Events',
      'menu_title'    => 'Add Events',
      'capability'    => 'create_eventss',
      'menu_slug'     => 'post-new.php?post_type=events',
      'function'      => null,// Uses the same callback function as parent menu. 
    ),
  )

[Vladimir]

I do not see the reason for that. I will make my own tests and try to repeat this.

[James Wee]

Do test it out and share back your findings. If you want my code please let me know 🙂

[Vladimir]

Yes, send your code to the support email. It will save to me some time.

[Vladimir]

I see just menu definition code at the provided file. Did you define your custom post types somewhere else?

[James Wee]

Dear Vladimir,

The Custom Posts Types were handled by CPT UI. If you’re looking for the respective post’s capabilities, they are:

Capability Types
news
events

[Vladimir]

Thanks. I got it.

[Vladimir]

A workaround which will allow to not define ‘dummy’ ‘Add New’ submenu items is to add to the user role ‘create_posts’, ‘edit_posts’ capability. It’s possible to block that menu with URE Pro “Admin menu access” add-on.

In other cases WordPress requires that there was a correspondent menu item available for current user if he tries to access ‘post-new.php’ page.

You can find logic at user_can_access_admin_page() function.
It’s located at wp-admin/includes/plugin.php file, line # 1697.
It’s called from wp-admin/includes/menu.php file, line # 333.

[Author]

Posts