Advertisement
  1. Code
  2. WordPress
Code

Create a Simple CRM in WordPress: Restricting / Hiding Menu Items

by
Difficulty:IntermediateLength:ShortLanguages:
This post is part of a series called Create a Simple CRM in WordPress.
Create a Simple CRM in WordPress: Extending WordPress Search
Create a Simple CRM in WordPress: Using Custom Capabilities

We’ve been looking at how to create a simple CRM system in WordPress. In the last part of this series, we added code to our plugin which allowed us to search our contacts based on the data stored in Advanced Custom Fields.

Today we’ll cover how to restrict access to WordPress Administration Menu items.

Roles and Capabilities

WordPress uses the concept of Roles, where a Role can be assigned to a WordPress User. This Role defines what the User can and cannot do.

By default, WordPress has six roles:

  • Super Admin
  • Administrator
  • Editor
  • Author
  • Contributor
  • Subscriber

The permissions that a Role has are referred to as Capabilities, and WordPress provides lots of different capabilities (for example, install_plugins, update_themes, edit_pages, etc). If you’re interested in seeing the full list of Capabilities based on Role, see this WordPress Codex Page.

When we registered our Contacts Custom Post Type in Part 1 of this series, we defined the capability_type to be post. This means that the read, edit and delete capabilities for Contacts are the same as used for Posts. Depending on the User’s Role, this gives the User the following access to our Contacts Custom Post Type:

CapabilitySuper AdminAdministratorEditorAuthorContributorSubscriber
edit_others_postsYesYesYes   
delete_others_postsYesYesYes   
delete_private_postsYesYesYes   
edit_private_postsYesYesYes   
read_private_postsYesYesYes   
edit_published_postsYesYesYesYes  
publish_postsYesYesYesYes  
delete_published_postsYesYesYesYes  
edit_postsYesYesYesYesYes 
delete_postsYesYesYesYesYes 

Editors and Authors

Based on the above capabilities, if we want Users to be able to add, edit and delete all Contacts (including Contacts created by other Users), we’d need to use the Editor role. Let’s go ahead and create a new WordPress User with that role:

  1. Navigate to Users > Add New in the WordPress Administration Menu.
  2. Complete the username, email and password fields.
  3. Set the Role of the User to Editor.
  4. Click Add New User.

Screen Shot 2014-12-30 at 124335

Now let’s log out of WordPress and log in as our new Editor. You’ll see that the WordPress Administration Menu has fewer options, and includes our Contacts Custom Post Type:

Menu Comparison Administrator Left vs Editor Right

However, you may only want Users to be able to view other Users' Contacts without having the ability to edit or delete them. We can achieve this by using the Author role, as this role does not have edit_others_posts or delete_others_posts Capabilities (refer to the table above).

Create your WordPress User in the same way as we did for an Editor, this time choosing the Author role instead.

Logging in as an Author will again show fewer WordPress Administration Menu options:

When we view our Contacts, you’ll see all other Contacts created by other WordPress Users—however, we’re not able to edit or delete them:

The Contacts Custom Post Type when viewed as an Author

Go ahead and add a new Contact. Once done, click on All Contacts in the WordPress Administration Menu. Instead of seeing all Contacts created by other WordPress Users, you’ll now see Contacts that you have created, which you’re able to edit and delete:

Viewing the Authors own Contacts in WordPress

We can still view other Users' Contacts by clicking the All option above the WordPress Table:

How to access all Contacts in WordPress

Up Next…

In the next article, we’re going to further restrict WordPress Administration functionality to selected Users, allowing them to only access the Contacts CRM.

Advertisement
Advertisement
Looking for something to help kick start your next project?
Envato Market has a range of items for sale to help get you started.