|
Patrick
|
August 25, 2019 at 8:52 am
Hi EE Team,
Using the Members (Justin Tadlock) plugin, I am trying to create a role with the following capabilities :
read
ee_edit_checkin
ee_edit_checkins
ee_edit_contact
ee_edit_contacts
ee_edit_payments
ee_edit_registration
ee_edit_registrations
ee_read_checkin
ee_read_checkins
ee_read_contact
ee_read_contacts
ee_read_event
ee_read_events
ee_read_message
ee_read_messages
ee_read_registration
ee_read_registrations
ee_read_transaction
ee_read_transactions
ee_send_message
I am facing the following issues :
1) Inconsistent capabilities available through Members plugin
On my live site, all capabilities are available and can be set through the Members plugin except the plural ee_edit_contacts capability. On my dev site, the following singular capabilities does not show in the Members plugin : ee_edit_checkin, ee_edit_contact, ee_read_checkin, ee_read_contact, ee_read_message, ee_read_registration.
2) Transactions of others are available and editable by all
I noticed that there are no ee_read_others_transaction(s) and ee_edit_others_transaction(s) capabilities in EE4 system. Does that mean it is not possible to filter the list of transactions to prevent an event author from reading and editing others transactions ? Any custom PHP function that would solve this ?
Best regards.
Patrick
|
|
Patrick
|
August 27, 2019 at 7:21 am
As a complement to my topic, here are some thoughts for my first question related to inconsistent capabilities between my dev site and my live site :
After reading Justin Tadlock Meta Capabilities for custom post types, it seems that the meta capabilities (singular as listed above) are not visible on my dev site. In addition, Justin mention that these meta capabilities are “Meta capability assigned by WordPress. Do not give to any role.”. Does that mean I should not assigned them for my event role ? Either way, that does not explain why a plural capability is missing on my live site.
|
|
Patrick
|
August 27, 2019 at 8:48 am
I found Josh answer in a topic similar to my second question How to Hide List of All Transactions from Event Administrator Clone?. So, as a complement to my second question : Since we cannot hide other events transactions, is it possible to at least grant an event admin to apply payments and refunds. In other words, does the ee_edit_payments can be granted without ee_read_transaction(s) ?
|
|
Josh
|
August 27, 2019 at 3:49 pm
Hi,
Since the payments UI is on the transactions page, they’ll need to have access to transactions.
|
|
Patrick
|
August 27, 2019 at 4:13 pm
Thank you Josh. Guest I will have to try customizing this through EE:: Registry wrapper.
What about my first question ?
|
|
Josh
|
August 28, 2019 at 11:26 am
In addition, Justin mention that these meta capabilities are “Meta capability assigned by WordPress. Do not give to any role.”. Does that mean I should not assigned them for my event role ?
That’s correct. A capability like ee_read_contact is a Meta capability, so the Members plugin correctly doesn’t give you the ability to assign that to a user role.
On my live site, all capabilities are available and can be set through the Members plugin except the plural ee_edit_contacts capability.
I’m not sure why you’re not seeing that capability. You could try deactivating, then reactivating the Event Espresso plugin. Also, the ee_edit_contacts capability will be listed under “Contacts” in the Members plugin UI.
|
|
Patrick
|
August 28, 2019 at 7:17 pm
Thanks Josh,
On my live site, the Members plugin is indeed giving me the ability to set the Meta capabilities. Should I then unchecked all of them ?
Regards,
Patrick
|
|
Josh
|
August 29, 2019 at 6:44 am
Hi Patrick,
I do not know what will happen if you do that, it’s unusual to see meta caps listed alongside primitive capabilities like that.
|
|
Patrick
|
August 29, 2019 at 11:13 am
Hi Josh !
I noticed that a few topics in this forum have discussions about capabilities. Some of them recommend assigning Meta to a role (See Tony’s example here).
Sorry to insist on this issue I am facing, but I really need to understand what is happening under the hood in order to prevent further related issues. Up now, I was able to customize 99% of Event Espresso through PHP, CSS and Javascript. I ma sure I can accomplish the last 1% with your help ! I don’t need you to provide code snippets, but only to point me in the right direction.
And thanks again for your patience.
Regards,
Patrick
|
|
Josh
|
August 29, 2019 at 11:24 am
Hi Patrick,
The issue seems to be you’re unsure what to do with those meta caps. You could try removing them to see what happens. If nothing breaks, then you’re good to go.
|
|
Patrick
|
August 29, 2019 at 5:58 pm
Hi Josh,
Here is an update. Justin Tadlock just clarified this to me :
Technically, capabilities only exist if they are assigned to at least one role. Otherwise, unless the capability is registered via a custom post type, a custom taxonomy, or by utilizing Members’ cap registration API, Members won’t display it.
So, as a test, I have removed the ee_delete_contact meta capability from all roles, including admin. Magic, the capability vanished from the list and I am still able to delete contacts !!! Of course, the primitive capability named ee_delete_contacts is still assigned to the role.
After that, I removed all singular capabilities (which I presume are all meta capabilities) from my event manager role and everything still works as expected. Nevertheless, I will not cleanup everything for now as keeping meta capabilities assigned to roles does not seem to be harmfull in anymway. I will keep that for later when my event is closed and traffic to my site is lower.
Again, thanks for your help. If you wish, you can now close this topic (unless you would like to add anything…).
Cheers !
Patrick
|
