Is There a Plugin That Helps lock some parts of the Dashboard

I am running WP Multi-site and using the new blog template plugin. When I create the template blog I notice that I can use the lock post plugin to prevent anyone from accessing the pages or posts and making changes. However, my theme has a panel when you can add sliders, menus, navigation and social media features. What I would like to do is prevent parts of the theme from being modified and other parts such as the social section to be accessible. Is there a plugin that would allow me to do that or is there a work around to close off parts of the theme setup?

thank you

  • Timothy Bowers

    There was a recent discussion here:

    https://premium.wpmudev.org/forums/topic/controlling-user-access-to-dashboard

    I'm not sure you fully comprehend how user roles work though. Only super admins and normal admins of a given site can access theming options. Anything editor level or below does not have that access.

    Take a look over at the WordPress Codex for a more index explanation:

    http://codex.wordpress.org/Roles_and_Capabilities#Capability_vs._Role_Table

    Only trusted parties should have admin access to your site. In multisite environments a site owner will have admin access of their own blog but not your main blog or other sub blogs.

    Hope this helps. :slight_smile:

  • Nu Eranet

    Hi Tim,

    thanks for the follow-up, I am familiar with the editor role but the challenge is allowing some theming options to be active while preventing access to other features in the theme panel. Each blog we give to a member under the multi-site network is their's to manage except for changing plugins, changing some of the pre-written pages and posts that we designate as master files. The members can not add or delete plugins or change the theme look. I will look at the other discussions and see where it takes me. . .

    It looks like there are some possibilities in those discussions.

    Thanks for the info.

  • wpcdn

    I'm not sure exactly which features you want to restrict, so I'm not sure if the following advice will be helpful.

    We limit access to certain theme features, such as:

    - Adding header / footer code (so users can't add their own JavaScript and such)
    - Adding a favicon (since we offer a global plugin for this)
    - Seeing support links for the theme vendor (since sub-site users aren't likely to have accounts in the theme providers' support forums)

    ...etc.

    We make these kinds of changes directly to the theme, either editing the theme files or a child theme. The methods vary depending on the theme provider. For example, for StudioPress we add functions to the theme's functions.php file to disable or modify features. For others, we simply remove functions from the admin panel and other PHP.

    Or are you talking about entirely different kinds of changes to themes?

    Mark

  • Timothy Bowers

    Ah I see, so you want to limit blog owners on what they can edit.

    You could disable plugin access. Network Admin -> Settings -> Settings (See Screenshot).

    Unless they are super admin they cannot add and delete plugins in a multisite install, only activate and deactivate.

    Not sure how you would tackle preventing them from editing certain pages or posts. I'm not sure of a way to prevent them accessing theme options if they have admin access unless you edit the actual code. I've not tried the plugins in the other thread I mentioned, there could be something there to help you! :slight_smile:

    The Supporter Plugin can also limit access to theme and plugins. You can set access for plugins as:

    Supporters (Auto-Activate)
    Supporters
    Anyone
    None

    Themes can be turned on or off with no options for setting panels.

  • Nu Eranet

    Hi Mark,

    I use the AWAKE theme and it has a framework panel that allows me to make changes to a lot of the theme sections. The only section we want them to be able to access is the social section.

    The rest we would like disabled. This is right now the challenge. Maybe the best thing is to just set up a form and collect the information for the social section and then just make them Editors of that blog.

    Thanks for the feedback.

    Andros

  • Nu Eranet

    H Tim,

    Yes, each blog I create with the multi-site will be accessed by a single individual only. They can add pages and posts and edit them as well. But the plugins and the me changes are going to be limited. Any pages I provide originally including legal and privacy pages are also going to be blocked from changes.

    To prevent them from editing pages and posts, I am using the LOCK POSTS plugin from wpmudev. This is a fantastic plugin and it works really well. So when a page is marked locked the page can not be edited by the blog member unless super admin is enabled as there permission. That will never be the case, the most they would have is admin.

    I thought about supporter but not offering the blog member the option to pay for the upgrade, if that is doable. I will try using supporter and see how it works.

    Thank you,

    Andros

  • wpcdn

    Hi Nu,

    I assume you're referring to the AWAKE theme that's on ThemeForest (and the settings panel in the image I've attached)? I love that theme and would have loved to use it (and InFocus) on our mutlsite network, but ThemeForest's licensing is too cost-prohibitive. For use on a WordPress multisite network, they require an Extended License, and I'm not going to pay $2000 per theme to use them.

    As for blocking those items from users, different themes handle it differently. For this theme, you'd just need to search the code and remove the parts that make those particular tabs appear. If you've done much code editing in the past, you'll probably see what I mean pretty quickly. For example, search the theme files' content for key phrases that appear in the names of the tabs and the settings, and you'll see where they're generated.

    However, I'm curious as to why you want to remove almost all of the theme's custom functionality. I don't know anything about the network you're setting up, but I know that the theme's flexibility is part of its appeal...for example, allowing users to set their sales pitch blurb and a link. I probably shouldn't recommend anything without knowing your purpose, and forgive me if I'm out of line. But as an end-user I'd love to have the full functionality of the theme (or at least most of it). If we were using this theme we'd leave most of that functionality in place. But we would sanitize it to prevent users from putting their own JavaScript in various fields.

    Mark

  • Nu Eranet

    Hi Mark,

    Yes that is the theme. The project involves providing members with a pre-written, pre-designed blog site that they use to promote a common product. All the content is standard for every member except for the about page, the additional pages they add and all the blog posts. So I need to make sure they can not make changes to the pre configured content. They will not be allowed to add or remove plugins either.

    Its almost like a replicated site. and they get access to the about, their personal pages and blogs. These members really don't want to do any editing of the theme of make changes. What they want is to be able to build posts and add extra pages . . . apart from that they want me to do all the dirty work and manage the look and feel.

    In the image you supplied the panel has several sections, and the only two I would like to give them access to is Sociable and Blog in the awake theme panel.

    I was hoping to avoid the hard coding side of things but I may not have a choice.

    And yes both Awake and InFocus are a dream to work with. Love the theme big time. However Awake is still not 3.1 ready according to the last info I got. Bummer.

    Oh! I forgot to mention, I will have two levels of users. The first are just members who have zero knowledge of managing a blog site and just want it all done for them. The second group are leaders in the team that will have more functionality and more privileges.

    andros

  • wpcdn

    Nu,

    Ah, I understand. I hope I didn't offend you by asking why you wanted the features removed. I figured that the more I knew about your needs, the better recommendations I could make. But I also figured that you had a reason for your plan, which I now understand.

    I know you're trying to avoid hard-coding, but the coding we're talking about isn't that hard. :wink: Yes, pun intended. It can be intimidating the first time, but once you see how the theme is set up it's very easy. I would be happy to help, but I'm in the middle of a very hectic time (semi-vacation with a huge workload anyway). So if I can find a few moments I'll try to point you in the right direction. Since I have the theme as well, it will be easy. When is your launch?

    Keep in mind that, as Tim mentioned above, there are two approaches:

    - Put in Super Admin checks; or
    - Simply remove the sections.

    Simply removing is cleaner and easier to do because you don't have to create any if/then directives or test how well they work. However, that extra coding is not very complex either. Do you have a preference as to which approach you'd prefer?

    Mark

  • Nu Eranet

    Hi Mark,

    No offence taken, I think and believe that in asking the right questions you always find better answers or solutions.

    I have not problem going into the code and making the adjustments, even though programming is not my strong point.

    What I am doing right now is dotting all the i's and crossing all the t's in the main site. This is what I have done so far:

    a main site was originally created under the domain.com. Then using a cloning plugin I made a sub-domain called member.domain.com. The main domain will be used to demonstrate what is being offered and will not go through too much change if any.

    The sub-domain is currently being updated with all the final touches, making sure images and plugins as well as pages, etc. are in place. This sub-domain will be used as the master domain that will be used to create the blog template using the wp mudev "new blog template" plugin. From this domain a master template will be forged. Then all other ember domains will be copied from this template. Hence any changes we make to this template will affect all the other domains.

    It looks like there is one step or two more than there should be, but its a safety precaution to make sure everything fits into place nicely ( I hope). So, the new blog template plugin worked. The template was deleted until the members.domain.com is final and ready to be cast in stone.

    This is where I would like to see the awake theme panel limited and only allow access to the Social and blog setting for the theme panel.

    On Sunday I will try the plugins that were originally recommended. If they do a clean job then I am all set to go. If not then I will consider surgery and change the code ( your guidance will be greatly appreciated). If I know where to look I can figure out what to block out. I just want to make sure that I can revert back to it in the event we need to make changes using the blocked out features of the theme panel.

    Okay . . . that's a lot of info. . . . sorry.

    Andros

  • wpcdn

    On Sunday I will try the plugins that were originally recommended.

    I'm not thinking that they'll do what you want. They provide general restriction, I believe, whereas you are trying to fine-tune access to particular features in a given theme. I think (and I may be mistaken) that the only way to do that is to edit the theme files.

    It really isn't as foreboding as it sounds.

    I just finished an 11-hour drive so I'll be among the sleeping for a while...will check back later.

    Mark

  • Timothy Bowers

    I just found this module which might also interest you, its from one of the developers here, maybe he posted about it but it seems like a kept secret to me. lol

    http://wordpress.org/extend/plugins/multisite-plugin-manager/

    Plugin management for WordPress Multisite that supports the native plugins page and the WPMU DEV Supporter plugin! Used on thousands of multisite installs across the web. Previously known as WPMU Plugin Manager, it uses a backend options page to adjust plugin permissions for all the sites in your network.

    Select what plugins sites have access to
    Choose plugins to Auto-Activate for all new blogs
    Mass activate/deactivate a plugin on all sites in your network (Very Handy!)
    Assign special plugin access permissions for specific sites in your network
    And as Super Admin, you can override all these to activate specific plugins on the sites you choose!
    Removes the plugin meta row links (Version, Author, Plugin) and any update messages for blog admins

    Its from http://uglyrobot.com/

    Just thought I would mention it! :slight_smile:

  • Nu Eranet

    Hi Mark,

    That would be great . . . thank you for the offer. Today I'll be testing some of the plugins that were recommended above and then if the results are not what we were looking for then we will tackle the idea of modifying some code.

    The one think that concerns me with modifying the code is when the time comes to update the theme how much of a mess will it be. The current Awake theme is still having issues with WP 3.1 and they are suppose to have an update soon.

    Andros

  • wpcdn

    thank you for the offer

    Glad to help.

    Today I'll be testing some of the plugins that were recommended above and then if the results are not what we were looking for then we will tackle the idea of modifying some code.

    The plugins that have been mentioned are good, but I don't think they'll achieve what you're looking for with the theme. I could be wrong though. It's happened before. :wink:

    The one think that concerns me with modifying the code is when the time comes to update the theme how much of a mess will it be. The current Awake theme is still having issues with WP 3.1 and they are suppose to have an update soon.

    I wouldn't worry too much about this. The changes are actually pretty straightforward. Once we dive into this, you'll see what I mean. You'll simply be removing or hiding entire sections of the admin panel. The modifications might sound intimidating, but they're actually fairly simple.

    When an updated theme is released, you'll want to compare the same file in the updated version and make sure that the same code modifications will apply to the new version. I assume that the upcoming theme changes won't affect the things we'll be editing too much.

    Mark

  • Nu Eranet

    Hi Mark,

    The plugins did not work exactly as hoped and I found that they actually made things messy to manage. I like the KISS concept when it comes to managing the content.

    I think the coding way will have to be the way to look at this issue. Just going through the steps of what is needed for the member to have access in the dashboard. The Editor permissions is too restricting, then need more freedom.

    Today's challenge was the new blog template. The plugin is allowing to replicate the blog from a master template file when we create a new sub-domain site. But I can not get changes that I make to the original master template to propagate to the new blogs.

    That said I did not touch the other stuff . . . .

    One step at a time. . . lol

    Andros

  • DavidM

    @Andros, I responded in your other thread regarding New Blog Templates and we can take that part of the discussion from there if you'd like, as this discussion's getting a bit lengthy! :slight_smile:

    I should also mention that the Membership plugin has a rule to restrict not only the main admin menus but the sub-menus as well, as you like. It can also be setup to use a global database table so that membership settings persist from site to site, for ultimate multisite control. The option is in the membership-config.php file.
    https://premium.wpmudev.org/project/membership

    @Mark and Tim, excellent insight as usual. You guys are just awesome! Mark, your advice regarding multisite theme customization really is the best I could imagine. It's just the best way, I think, to provide exactly what you want as far as limitations on what can be customized theme-wise on a multisite.

    And I just had to interject regarding the Awake theme. While I haven't tried the theme myself, the folks behind it really are incredible and provide an arsenal of web resources (icons, textures, photoshop stuff) that are simply incredible.
    http://webtreats.mysitemyway.com/category/wordpress-themes/

    Cheers,
    David

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.