Capabilities: delete_users

[adleviton]

It looks like access to pods is solely based on one wordpress capability: delete_users.

What should I do if I want a client to be able to delete users and NOT have access to pods?

[Shelob9]

@adleviton I'm not sure what's leading you to that assumption. Are you talking about an extended users object Pod or all Pods? Can you explain what you're trying to do please so I can understand better how that capability is affecting you?

[adleviton]

Sure. I would like to have a wordpress role that can create, edit, and delete other wordpress users, but restrict them from the pods admin area. This way they can manage users, but they won't accidentally mess anything up in the pods admin area. Let me know if that makes sense.

[Shelob9]

Why not create a role using the Roles & Capabilities plugin with those roles, but not give it the capability to edit Pods admin?

[sc0ttkclark]

pods_is_admin uses the 'Super Admin' checks from WordPress, which all fallback on 'can they delete users'. There's a filter we have in Pods that can let you override access, @Shelob9 has that info he can pass onto you.

[Shelob9]

See:
https://github.com/pods-framework/pods-code-library/blob/master/example/hooks/filters/pods_is_admin/examples/set-level.php

[adleviton]

Thanks guys, looks like I got it working.

[pglewis]

3.0 milestone clearing

[quasel]

from @JoryHogeveen #3625

Currently the admin capabilities check for the delete_users capability in pods_is_admin() (includes / general.php).
I've would like to see this changed into manage_options or administrator since Pods is a options page...

An other idea is to just use the is_super_admin() function since this function also works for non-multisite installations.

is this still an issue or just a doc's issue?

[quasel]

and from @sc0ttkclark #3985

There's a filter where you can override all access checks via pods_is_admin(), the filter is named pods_is_admin.

For single site installs, you can disable access from delete_users capability by using the filter:

add_filter( 'pods_admin_capabilities', '__return_empty_array' );

[JoryHogeveen]

is this still an issue or just a doc's issue?

I'd say a doc issue. Pods follows WP currently so I'd say that is good.