Change WordPress user roles and capabilities Forums Bug Reports Pro version – multisite – shop manager can’t delete product attributes Reply To: Pro version – multisite – shop manager can’t delete product attributes

#6800
Vladimir
Keymaster

Thanks for the provided access. I confirm a problem and can reproduce it at my test environment to make further investigations.
The reason is that post editing ‘edit.php?…’ link is blocked via ‘Admin menu’, but WooCommerce uses the same link with another set of parameters for the product attributes deletion. Somehow URE Pro counts the ‘edit.php?post_type=product&page=product_attributes&delete=4&_wpnonce=…’ link as blocked and redirects user to the dashboard instead. I have to investigate the issue to decide if it’s possible to find the solution for this conflict.

Generally, ‘Admin menu’ is the secondary level permissions tool. 1st level is always capabilities. We should revoke all unneeded capabilities from the role 1st. I see that you fully blocked for shop_manager role via “Admin menu” the “Appearance”, “Users”, “Links” menus. If revoke “edit_theme_options”, ‘list_users’ and ‘manage_links’ capabilities from shop_manager role, then this menus will be blocked for the role by WordPress itself.

The same is correct for the ‘Pages’ menu. I revoked all ‘_pages’ capabilities from shop_manager role at the demo site and this menu was disappeared from the user access.

The same is true for all custom post types menus, currently protected by ‘edit_posts’ capability. If revoke, all ‘_posts’ capabilities from shop_manager role, then you will not need to block related menus via ‘Admin menu’. It resolves the issue, when shop manager can not delete product attributes also.

Possible problem with this workaround is the ‘edit_posts’, ‘edit_published_posts’, ‘edit_others_posts’, ‘delete_posts’ capabilities are required by default for editing Media Library items.

I will inform you about the result of my further investigations on the subject.