Action Listeners locked to manage_options
-
Hi
I have just updated our UM installations from a fairly old version 2.5.* to the latest 2.9.1. This has had an impact for Editors within the admin area, as they now cannot change user statuses … which they could prior to v2.8.7. This was introduced when the action listeners and the quick actions on a user were added, based on this article:
https://docs.ultimatemember.com/article/1943-guide-to-ultimate-member-managing-users-in-wordpress
I have had a look at the code within the UM file /ultimate-member/includes/admin/class-actions-listener.php and within the actions_listener function, there is a short circuit if the user submitting the action does not have the “manage_options” capability. This a big assumption, especially when later in the function you are checking if the user can edit users, which would make more sense. This means although an Editor can see the quick actions menu against a user, within the admin area, they cannot use it.
Can this be changed in later releases to either a custom cap or a hook / filter where a dev can pass in a custom cap? It shouldn’t be locked to manage_options, as giving this cap enables pretty much ALL the admin area, which certain user roles should definitely not have.
Please let me know your thoughts,
Many thanks
Tom
- You must be logged in to reply to this topic.