Vladimir Garagulya

Hi András,

I agree to investigate your site issue with users.php page.
Contact me directly via support [at-sign] role-editor.com to proceed.

“Add Role” is designed not to change current role, but to really add the 2nd role to the primary one. Thus if user has ‘Customer’ role, then after adding role ‘Private user’ user will have 2 roles simultaneously: ‘Customer’ and ‘Private User’ – as expected.

In order to replace currently grunted role with another one for the list of selected users – you have to use WordPress built-in ‘Change role’ dropdown list or “Grant Roles” button from User Role Editor.

Hi,

It’s not possible without custom plugin, which is not easy to write. For example to swap image you have to change the link to the image, etc.

Hi,

Thank you.
I will reindex the array of roles granted to user after the modification of the list of roles/capabilities granted to a user.

Hi Morten,

URE does not change itself permissions required by WordPress or WooCommerce Rest API.

Check if your user can permission checked by WooCommerce REST API. For example, WooCommerce file class-wc-rest-shipping-zones-controller-base.php checks user permissions via function below, and requires ‘manage_woocommerce’ for ‘shipping_methods’ $object argument value:

/**
 * Check manager permissions on REST API.
 *
 * @since 2.6.0
 * @param string $object  Object.
 * @param string $context Request context.
 * @return bool
 */
function wc_rest_check_manager_permissions( $object, $context = 'read' ) {
	$objects = array(
		'reports'          => 'view_woocommerce_reports',
		'settings'         => 'manage_woocommerce',
		'system_status'    => 'manage_woocommerce',
		'attributes'       => 'manage_product_terms',
		'shipping_methods' => 'manage_woocommerce',
		'payment_gateways' => 'manage_woocommerce',
		'webhooks'         => 'manage_woocommerce',
	);

	$permission = current_user_can( $objects[ $object ] );

	return apply_filters( 'woocommerce_rest_check_permissions', $permission, $context, 0, $object );
}

• This reply was modified 4 years, 11 months ago by Vladimir Garagulya.
• This reply was modified 4 years, 11 months ago by Vladimir Garagulya.
• This reply was modified 4 years, 11 months ago by Vladimir Garagulya.

Revoke from a role all ‘ure_’ capabilities. It will prohibit editing roles and capabilities, but if user has list_users, promote_users, edit_users, such user will can grant/revoke roles as user admin.

In order to grant capabilities directly to users (via ‘Capabilities’ link under the user row) currently user should can ‘ure_manage_options’ – superadmin capability for URE plugin.

URE tries to prevent the accidental revoking capabilities from the administrator role as this role is a superadmin for single site WordPress and user can lose access to the site after revoking critical capabilities from it. It seems you found a way how to make this. Thank you. I will close it with the next update.

It depends from the capabilities granted to a role and plugins active on website.
For example WooCommerce redirects to front-end any user if he can not some capabilities, view_admin_dashboard, for example. Read this article for more information about admin dashboard access with active WooCommerce.

URE does not include any special support for Elementor.

URE supports Elementor in the part where Elementor uses WordPress built-in user permissions system: capabilities and roles.

In order to change site presentation webdesigner should can place files to web server file system. Having this access (only via installing new plugins and/or themes) you can get WordPress superadmin privileges in a minute. There is no sense to restrict access of such power user via WordPress user roles.

You have 2 variants:
1) If you have some critical data at your site, which you can not show, setup a separate stage copy of website with dummy data and without real users, give to webdesigner full permissions and when he/she will finish work on a design update, transfer updated files to the live site yourself.

or

2) Find webdesigner to whom you will trust enough to give access to the real data.