Description
JMDL Booking Role Access Manager provides a central role-based access screen for WordPress administrators.
It can control:
- WordPress admin top-level menus and submenus.
- Runtime WordPress and plugin capabilities without rewriting stored role capabilities.
- Per-role login and logout redirects.
- Amelia admin menu visibility and read-only access when Amelia is detected.
- YITH Booking internal panel navigation when YITH Booking and Appointment for WooCommerce is detected.
- Optional Amelia Manager compatibility for roles that need broader Amelia record visibility.
- Emergency safe mode and per-role configuration backups.
The plugin does not create, update, or delete booking, appointment, order, customer, payment, or booking-table records. Menu hiding is an interface control; capability and read-only controls should be used when direct access must also be restricted.
This plugin is independently developed and is not affiliated with or endorsed by Amelia or YITH. Product names are used only to describe optional compatibility.
Security and data safety
- Settings forms require administrator capability checks and WordPress nonces.
- Redirects are restricted to same-site destinations.
- Capability policies are applied at runtime instead of rewriting WordPress role capability records.
- Compatibility-role ownership is tracked per user so the plugin removes only roles it added itself.
- User synchronization is role-scoped and batched.
- Empty admin-menu selections fail open instead of hiding the complete WordPress admin sidebar.
- Administrators and multisite super administrators bypass restrictions.
Always test role-access changes on staging before deploying them to a production booking site.
Privacy
This plugin does not send data to external services and does not include analytics or tracking.
Installation
- Back up the site before changing access-control rules.
- Upload and activate the plugin.
- Open Settings > Role Access Manager.
- Select a WordPress role.
- Enable only the modules that should be managed for that role.
- Save the profile.
- Sign the affected user out and back in, then test in a private browser window.
Administrators and multisite super administrators bypass restrictions to reduce lockout risk.
FAQ
-
Does this plugin modify booking records?
-
No. It does not write to Amelia or YITH booking tables and does not modify appointments, bookings, orders, customers, payments, or booking metadata.
-
Not by itself. Menu visibility changes the interface. Use the capability controls and, for Amelia read-only roles, the read-only security mode when direct mutation access must also be denied.
-
What does Emergency safe mode do?
-
It temporarily disables this plugin’s menu restrictions, capability overlays, redirects, compatibility-role synchronization, and read-only enforcement while preserving saved profiles. Administrators can turn it off after correcting a configuration.
-
Why is Amelia Manager compatibility optional?
-
Some Amelia versions scope backend records by Amelia’s built-in roles. Compatibility mode can add the built-in Manager role while this plugin keeps the managed role’s access policy authoritative.
-
What happens if Amelia or YITH Booking is not active?
-
The related integration settings are hidden. Existing saved settings remain stored so they are available if the booking plugin is activated again.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“JMDL Booking Role Access Manager” is open source software. The following people have contributed to this plugin.
Contributors
Translate “JMDL Booking Role Access Manager” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.4.5
- Changed YITH Dashboard children to an explicit whitelist: the Dashboard parent no longer makes All Bookings, Bookable items, or Bookings Calendar visible automatically.
- Added a CSS whitelist fallback for current YITH submenu markup so child visibility still works if YITH delays or rebuilds its JavaScript-rendered sidebar.
- Preserved the v2.4.4 Screen Options defaults and all existing role profiles.
2.4.4
- Fixed YITH Dashboard child-menu hiding against the current
.yith-plugin-fw__panel__submenu-itemmarkup and exactdashboard-bookable-productsURL. - Added native WordPress default Screen Options behavior for YITH Booking edit screens: Post Types, Booking actions, Post Visibility, and Booking notes start hidden until each user chooses otherwise.
- Existing per-user Screen Options choices remain authoritative and are not overwritten.
2.4.3
- Fixed YITH Dashboard child-menu visibility so unchecked items such as Bookable items are reliably hidden across current YITH sidebar markup variations.
- Improved Dashboard submenu matching and observation without changing booking data or direct-access permissions.
- Synchronized the internal asset/version cache key with the public plugin version.
2.4.2
- Updated the public plugin identity to
JMDL Booking Role Access Manager/jmdl-booking-role-access-managerfor the requested WordPress.org slug. - Updated the plugin package folder, main plugin filename, readme name, settings title, and translation text domain to the JMDL identity.
- Preserved the existing
baram_*option keys and runtime behavior so configured profiles remain compatible.
2.4.1
- Applied WordPress.org review hardening and standardized the public plugin identity.
- Sanitized and allow-listed the HTTP request method before Amelia read-only request classification.
- Normalized checkbox request values through one sanitizing helper.
- Sanitized redirect form values as soon as they are received.
- Limited the Emergency Safe Mode admin notice to this plugin’s settings screen.
- Re-audited settings mutations to keep administrator capability checks and WordPress nonces in place.
2.4.0
- Refactored the plugin into a small bootstrap, core controller, settings view, and dedicated assets.
- Prepared the public package structure and WordPress.org metadata.
- Removed obsolete site-specific migration code from the runtime path.
- Stopped creating a Booking Receptionist role automatically; the plugin now manages existing WordPress roles only.
- Preserved the v2.3.6 access-control, safety-mode, Amelia, YITH Booking, menu, capability, and redirect behavior.
- Added GPL metadata and WordPress.org-ready readme fields.