Block Switching to Other Admins

I think the best implementation would be to block users who do not have the promote_users permission from switching to a user that has the promote_users permission.

A user can only switch to a user that they can edit, therefore the target user’s role isn’t of concern because if a user can edit the target user then they can change their role.

Do you have some custom roles, capabilities, or functionality in place on your site which means that’s not true?

The FAQ has a bunch of information about customising the capabilities for switching between users.

Hi @johnbillion,

Yes, my site uses custom roles which is why some users with the edit_users capacity don’t have the promote_users capacity. My understanding is that such users can edit most aspects of the website’s users but can not change user roles. If I have selected that they can not change user roles, then they should not be able to change to a user that can.

I read through the FAQs and managed to tweak the plugin code slightly to prevent the “Switch To” link from being generated if the target user can promote_users, but I would much prefer if this was either built-in or if I could at least implement this using a hook.

I believe editing the plugin PHP as follows acheives the desired goal, but I would much prefer this be included in the official plugin code or at least using a hook so that this tweak remains even after the plugin updates in the future:
/**
* Returns the switch to or switch back URL for a given user.
*
* @param WP_User $user The user to be switched to.
* @return string|false The required URL, or false if there’s no old user or the user doesn’t have the required capability.
*/
public static function maybe_switch_url( WP_User $user ) {
$old_user = self::get_old_user();

if ( $old_user && ( $old_user->ID === $user->ID ) ) {
return self::switch_back_url( $old_user );
} elseif ( ( current_user_can( ‘switch_to_user’, $user->ID ) ) && !user_can( $user->ID, ‘promote_users’ ) ) {
return self::switch_to_url( $user );
} else {
return false;
}
}

Cheers. I’m going to take a look at this next week.

Hi @johnbillion , Any progress on this?

I’ve approached this slightly differently …

My preference would be to expose the switching URL as a filter …

/**
* Returns the nonce-secured URL needed to switch to a given user ID.
*
* @param  WP_User $user The user to be switched to.
* @return string The required URL.
*/
public static function switch_to_url( WP_User $user ) {
		
	return apply_filters( 'switch_to_url', wp_nonce_url( add_query_arg( 		array(
		'action' => 'switch_to_user',
		'user_id' => $user->ID,
		'nr' => 1,
	), wp_login_url() ), "switch_to_user_{$user->ID}" ), $user );
}

Then you can just do

add_filter( 'switch_to_url', 'my_switch_to_url', 9, 2 );

function my_switch_to_url($url, $user) {
//your conditions here
return $url;
}

• This reply was modified 2 years, 5 months ago by bencoates.

@johnbillion , Following up again.

No progress on this, sorry. It’s not a priority for me.

@bencoates , The following code works with your suggested filter:

add_filter( 'switch_to_url', 'my_switch_to_url', 9, 2 );

function my_switch_to_url($url, $user) {
//your conditions here
if (!user_can( $user->ID, 'promote_users' )){
	return $url;
} else {
return false;
}
}

Could you make the necessary pull request via GitHub to add your suggested filter to the switch_to_url function: https://github.com/johnbillion/user-switching

I am not sure how to do that.

• This reply was modified 2 years, 4 months ago by wordna.
• This reply was modified 2 years, 4 months ago by wordna.