{"id":388164,"date":"2026-10-28T11:04:31","date_gmt":"2026-10-28T11:04:31","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/booking-admin-role-access-manager\/"},"modified":"2026-10-29T00:24:48","modified_gmt":"2026-10-29T00:24:48","slug":"jmdl-booking-role-access-manager","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/jmdl-booking-role-access-manager\/","author":15111390,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"2.4.5","stable_tag":"2.4.5","tested":"7.1.4","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"JMDL Booking Role Access Manager","header_author":"Jmarck Lascano","header_description":"Role-based booking-plugin menu access, WordPress admin visibility, runtime capabilities, and login\/logout redirects.","assets_banners_color":"cfd4de","last_updated":"2026-10-29 00:24:48","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":79,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"2.4.2":{"tag":"2.4.2","author":"jmarck","date":"2026-10-28 11:04:01","revision":3770495},"2.4.5":{"tag":"2.4.5","author":"jmarck","date":"2026-10-29 00:24:48","revision":3771892}},"upgrade_notice":{"2.4.5":"<p>Separates the YITH Dashboard parent from its child menu permissions so only explicitly checked child items remain visible.<\/p>","2.4.4":"<p>Fixes YITH Bookable items menu hiding and makes four YITH Booking meta boxes hidden by default while preserving each user&#039;s Screen Options choices.<\/p>","2.4.3":"<p>Fixes YITH Dashboard child-menu visibility for managed roles. Existing role profiles and settings are preserved.<\/p>","2.4.2":"<p>WordPress.org review update using the JMDL public identity. Existing <code>baram_*<\/code> role profiles and settings are preserved.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3770583,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3770583,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3770583,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3770583,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.4.2","2.4.5"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[1912,3720,269,895,11917],"plugin_category":[40,54],"plugin_contributors":[289178],"plugin_business_model":[],"class_list":["post-388164","plugin","type-plugin","status-publish","hentry","plugin_tags-access-control","plugin_tags-admin-menu","plugin_tags-booking","plugin_tags-permissions","plugin_tags-user-roles","plugin_category-calendar-and-events","plugin_category-security-and-spam-protection","plugin_contributors-jmarck","plugin_committers-jmarck"],"banners":{"banner":"https:\/\/ps.w.org\/jmdl-booking-role-access-manager\/assets\/banner-772x250.png?rev=3770583","banner_2x":"https:\/\/ps.w.org\/jmdl-booking-role-access-manager\/assets\/banner-1544x500.png?rev=3770583","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/jmdl-booking-role-access-manager\/assets\/icon-128x128.png?rev=3770583","icon_2x":"https:\/\/ps.w.org\/jmdl-booking-role-access-manager\/assets\/icon-256x256.png?rev=3770583","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>JMDL Booking Role Access Manager provides a central role-based access screen for WordPress administrators.<\/p>\n\n<p>It can control:<\/p>\n\n<ul>\n<li>WordPress admin top-level menus and submenus.<\/li>\n<li>Runtime WordPress and plugin capabilities without rewriting stored role capabilities.<\/li>\n<li>Per-role login and logout redirects.<\/li>\n<li>Amelia admin menu visibility and read-only access when Amelia is detected.<\/li>\n<li>YITH Booking internal panel navigation when YITH Booking and Appointment for WooCommerce is detected.<\/li>\n<li>Optional Amelia Manager compatibility for roles that need broader Amelia record visibility.<\/li>\n<li>Emergency safe mode and per-role configuration backups.<\/li>\n<\/ul>\n\n<p>The plugin does not create, update, or delete booking, appointment, order, customer, payment, or booking-table records. Menu hiding is an interface control; capability and read-only controls should be used when direct access must also be restricted.<\/p>\n\n<p>This plugin is independently developed and is not affiliated with or endorsed by Amelia or YITH. Product names are used only to describe optional compatibility.<\/p>\n\n<h3>Security and data safety<\/h3>\n\n<ul>\n<li>Settings forms require administrator capability checks and WordPress nonces.<\/li>\n<li>Redirects are restricted to same-site destinations.<\/li>\n<li>Capability policies are applied at runtime instead of rewriting WordPress role capability records.<\/li>\n<li>Compatibility-role ownership is tracked per user so the plugin removes only roles it added itself.<\/li>\n<li>User synchronization is role-scoped and batched.<\/li>\n<li>Empty admin-menu selections fail open instead of hiding the complete WordPress admin sidebar.<\/li>\n<li>Administrators and multisite super administrators bypass restrictions.<\/li>\n<\/ul>\n\n<p>Always test role-access changes on staging before deploying them to a production booking site.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>This plugin does not send data to external services and does not include analytics or tracking.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Back up the site before changing access-control rules.<\/li>\n<li>Upload and activate the plugin.<\/li>\n<li>Open Settings &gt; Role Access Manager.<\/li>\n<li>Select a WordPress role.<\/li>\n<li>Enable only the modules that should be managed for that role.<\/li>\n<li>Save the profile.<\/li>\n<li>Sign the affected user out and back in, then test in a private browser window.<\/li>\n<\/ol>\n\n<p>Administrators and multisite super administrators bypass restrictions to reduce lockout risk.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20modify%20booking%20records%3F\"><h3>Does this plugin modify booking records?<\/h3><\/dt>\n<dd><p>No. It does not write to Amelia or YITH booking tables and does not modify appointments, bookings, orders, customers, payments, or booking metadata.<\/p><\/dd>\n<dt id=\"does%20hiding%20a%20menu%20block%20direct%20access%3F\"><h3>Does hiding a menu block direct access?<\/h3><\/dt>\n<dd><p>Not by itself. Menu visibility changes the interface. Use the capability controls and, for Amelia read-only roles, the read-only security mode when direct mutation access must also be denied.<\/p><\/dd>\n<dt id=\"what%20does%20emergency%20safe%20mode%20do%3F\"><h3>What does Emergency safe mode do?<\/h3><\/dt>\n<dd><p>It temporarily disables this plugin's menu restrictions, capability overlays, redirects, compatibility-role synchronization, and read-only enforcement while preserving saved profiles. Administrators can turn it off after correcting a configuration.<\/p><\/dd>\n<dt id=\"why%20is%20amelia%20manager%20compatibility%20optional%3F\"><h3>Why is Amelia Manager compatibility optional?<\/h3><\/dt>\n<dd><p>Some Amelia versions scope backend records by Amelia's built-in roles. Compatibility mode can add the built-in Manager role while this plugin keeps the managed role's access policy authoritative.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20amelia%20or%20yith%20booking%20is%20not%20active%3F\"><h3>What happens if Amelia or YITH Booking is not active?<\/h3><\/dt>\n<dd><p>The related integration settings are hidden. Existing saved settings remain stored so they are available if the booking plugin is activated again.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>2.4.5<\/h4>\n\n<ul>\n<li>Changed YITH Dashboard children to an explicit whitelist: the Dashboard parent no longer makes All Bookings, Bookable items, or Bookings Calendar visible automatically.<\/li>\n<li>Added a CSS whitelist fallback for current YITH submenu markup so child visibility still works if YITH delays or rebuilds its JavaScript-rendered sidebar.<\/li>\n<li>Preserved the v2.4.4 Screen Options defaults and all existing role profiles.<\/li>\n<\/ul>\n\n<h4>2.4.4<\/h4>\n\n<ul>\n<li>Fixed YITH Dashboard child-menu hiding against the current <code>.yith-plugin-fw__panel__submenu-item<\/code> markup and exact <code>dashboard-bookable-products<\/code> URL.<\/li>\n<li>Added native WordPress default Screen Options behavior for YITH Booking edit screens: Post Types, Booking actions, Post Visibility, and Booking notes start hidden until each user chooses otherwise.<\/li>\n<li>Existing per-user Screen Options choices remain authoritative and are not overwritten.<\/li>\n<\/ul>\n\n<h4>2.4.3<\/h4>\n\n<ul>\n<li>Fixed YITH Dashboard child-menu visibility so unchecked items such as Bookable items are reliably hidden across current YITH sidebar markup variations.<\/li>\n<li>Improved Dashboard submenu matching and observation without changing booking data or direct-access permissions.<\/li>\n<li>Synchronized the internal asset\/version cache key with the public plugin version.<\/li>\n<\/ul>\n\n<h4>2.4.2<\/h4>\n\n<ul>\n<li>Updated the public plugin identity to <code>JMDL Booking Role Access Manager<\/code> \/ <code>jmdl-booking-role-access-manager<\/code> for the requested WordPress.org slug.<\/li>\n<li>Updated the plugin package folder, main plugin filename, readme name, settings title, and translation text domain to the JMDL identity.<\/li>\n<li>Preserved the existing <code>baram_*<\/code> option keys and runtime behavior so configured profiles remain compatible.<\/li>\n<\/ul>\n\n<h4>2.4.1<\/h4>\n\n<ul>\n<li>Applied WordPress.org review hardening and standardized the public plugin identity.<\/li>\n<li>Sanitized and allow-listed the HTTP request method before Amelia read-only request classification.<\/li>\n<li>Normalized checkbox request values through one sanitizing helper.<\/li>\n<li>Sanitized redirect form values as soon as they are received.<\/li>\n<li>Limited the Emergency Safe Mode admin notice to this plugin's settings screen.<\/li>\n<li>Re-audited settings mutations to keep administrator capability checks and WordPress nonces in place.<\/li>\n<\/ul>\n\n<h4>2.4.0<\/h4>\n\n<ul>\n<li>Refactored the plugin into a small bootstrap, core controller, settings view, and dedicated assets.<\/li>\n<li>Prepared the public package structure and WordPress.org metadata.<\/li>\n<li>Removed obsolete site-specific migration code from the runtime path.<\/li>\n<li>Stopped creating a Booking Receptionist role automatically; the plugin now manages existing WordPress roles only.<\/li>\n<li>Preserved the v2.3.6 access-control, safety-mode, Amelia, YITH Booking, menu, capability, and redirect behavior.<\/li>\n<li>Added GPL metadata and WordPress.org-ready readme fields.<\/li>\n<\/ul>","raw_excerpt":"Control admin menus, runtime capabilities, redirects, and supported booking-plugin navigation by WordPress user role.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/388164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=388164"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/jmarck"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=388164"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=388164"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=388164"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=388164"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=388164"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=388164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}