Restrict Access to Only Specific Post IDs Not Working

[digisavvy]

Hi there,
We’re using User Role Editor Version 4.58.2 on the latest version of WordPress.

The problem
A user role that has limited permissions, is able to see all pages in spite of us limiting their page access by ID.

What we did
We have created a custom role with limited permissions (screenshot)

We have set which posts the User can Access
(screenshot)

When the issue appeared
Seemed to occur after updating to the latest release

What we’ve tried
We tried disabling all other plugins and the issue persists.
Tested on an alternate website, the issue persists.
Triedd changing themes, just because, and the issue persisted.

[Vladimir]

Hi,

Can not repeat this at the latest test. Check if user has another role(s) granted, which has edit restrictions also and may change the result which you wish.

[Vladimir]

Clarify also what do you mean under “user can ONLY view certain page IDs”. I suppose – view allowed pages at the list of pages available for editing at the wp-admin, right?

[digisavvy]

Hi Vladimir,
Than you. The user in question has ‘view allowed’ to specific post IDs. My assumption is that the user can only view/manage the posts/pages that match the IDs that are input.

For the Role ‘Page Editor’ it should be allowed to create a page but only see pages that were created by the user or specific page IDs that are allowed in the WP Admin in their user profile. Video Explainer.

We’re using User Switching to troubleshoot this issue. We notice when we. switch to a user with Role Page editor, that they can see and edit any page (not good). We go into edit a page, and then exit, and we see only the pages the user is allowed to access.

[digisavvy]

Just to add to this, I created a new user with the appropriate role. I logged in as that user (not with user switching). At first I can see all pages. I edit a page, try to save and get an error that says I can’t edit that page, which is good. Then I go back to pages, and then I only see the one post I should see.

[Vladimir]

Do you use any caching plugin? If Yes, switch off caching for the restricted role.

[Vladimir]

Another question – if you repeat the test will it show the same result – all pages 1st, then the list according to restrictions?

[digisavvy]

Hey Vladimir,
Yes, if I repeat the test the same thing happens, even after clearing cache.
1. The user will first see ALL pages.
2. If they click edit on any page and then go back to pages, they will only see the pages they have access to.

[Vladimir]

Hi,

Send URL and administrator credentials to support [at-sign] role-editor.com, if it’s applicable. I will investigate your case. If you can setup a development copy it would be better.

[Vladimir]

Hi,

I reproduced your issue at my own test site. I will inform you when I find a reason and develop a fix.

Thank you for the report about this problem.

[digisavvy]

You are awesome, Vladimir. Thank you.

[digisavvy]

Hey Vladimir,

Just checking to see if this ever got resolved. =)

[Jean-Laurent]

Hi,

@Vladimir, +1 would really appreciate if you could fix this one ASAP.

Kind regards

[Vladimir]

Hi,

Beta version 4.59.2.b1 contains the required fix. It’s available after login from the same Download page, where you take a stable version.

Could you please test it and share the results?

[Author]

Posts