Support

Home Forums Event Espresso Premium Super granular user rights

Super granular user rights

Posted: December 6, 2016 at 3:36 am


ARAGATO

December 6, 2016 at 3:36 am

Hi there, I need your help.

The given wordpress/EE rights are not enough to hide some crucial elements that certain user roles are not allowed to see.

In particular, the values entered by an attende can be seen in the registration event detail under the Registration Form Answers.
http://uploads.aragato-server.net/screenshots/20161206b2c206fafe.png

These Answer contain critical data that an Event Manager for example is not allowed to see.
The same gapplies for the Registration overview page where it is possible to download a summary CSV of all registration INCLUDING the answer data of each attende.
http://uploads.aragato-server.net/screenshots/20161206640596d190.png

Unfortunately, the give rights management does not allow me to hide those elements for the event manager. Do you have any smart ideas of how to solve that problem?
I have none so far ;).

Thanks for your help.


ARAGATO

December 10, 2016 at 1:49 am

No response?


ARAGATO

December 11, 2016 at 11:14 pm

Could you at least give me a hint of where the HTML for those parts is generated (in which EE files) so I can hack it temporarily and hide it based on wp-roles?


Tony

  • Support Staff

December 13, 2016 at 5:19 am

Hi there,

Just to note, ‘bumping’ your threads effectively puts them to the back of the queue as we try to answer threads based on reply date (although not always)

So you want the event admins to be able to edit registrations made on their events, but not view the registration questions?

There is more to the EE capability system than the cap check which allows for what you are requesting, however it will take some coding on your part to set up.

Take a look here: https://github.com/eventespresso/event-espresso-core/blob/master/docs/K–Capability-System/ee-capability-system-overview.md

Paying particular attention to ‘contexts’ as it allows you to filter certain sections based on the capability AND context.

So…

In particular, the values entered by an attende can be seen in the registration event detail under the Registration Form Answers.
http://uploads.aragato-server.net/screenshots/20161206b2c206fafe.png

That metabox has and ID of ‘edit-reg-questions-mbox’ so if we search the EE codebase for how that metabox is added we’ll find:


if ($attendee instanceof EE_Attendee
            && EE_Registry::instance()->CAP->current_user_can('ee_edit_registration', 'edit-reg-questions-mbox')
) {
        add_meta_box('edit-reg-questions-mbox', __('Registration Form Answers', 'event_espresso'),
            array($this, '_reg_questions_meta_box'), $this->wp_page_slug, 'normal', 'high');
}

So that metabox relies on the ee_edit_registration capability, the second parameter is the context in which you are current running the check, in this example edit-reg-questions-mbox

So you have 2 options, you can remove the ee_edit_registration from the role (they can still view the registration but not make changes to it) but that will also effect any other areas of EE that use that capability.

OR

You can filter the above check, within the current context and remove the metabox from view. The link above explains how to do that, but we can run through this example to show you a little more:

https://gist.github.com/Pebblo/f0c2ab5e0295f7eca8e463f087ccf9e8

That code runs on a dynamic filter for the context, checks for the current capability (and if the current user can manage_options) and if not removes the meta box, whilst still allowing the user to have the ee_edit_registrations capability.

For the CSV you can do something similar using this the example functions we have to limit the CSV out:

https://github.com/eventespresso/ee-code-snippet-library/blob/master/admin/registration_report_limit_columns_shown.php

Use a current_user_can() check for say ‘manage_options’ again so if they aren’t admins, return the filtered CSV, otherwise return the standard csv_row var.

Could you at least give me a hint of where the HTML for those parts is generated (in which EE files) so I can hack it temporarily and hide it based on wp-roles?

We do not support hacking core files, so will not provide a list files you should edit to achieve specific features although we are more than happy to add additional hooks within EE should they be needed.

The support post ‘Super granular user rights’ is closed to new replies.

Have a question about this support post? Create a new support post in our support forums and include a link to this existing support post so we can help you.

Event Espresso