Vendor cannot delete listing without Contributor role

General HivePress
1

Hi there,

I already read about this topic here and saw that vendors cannot delete their listings, which is also the case for me.

I saw that there is a solution for it which seems to work. I gave the contributor the ability to “edit_posts” with the user role editor and then the vendor could delete the listing.

There is one issue with that: once I activated that ability, not only can the vendor delete his own listing, but also he has access to certain parts of the backend of Wordpress!

This is definitely not what I want and I cannot seem to find a workaround for that. Can you help me that the vendor can delete his listings but still has no access to the backend of WP?

I hope you know a way, thank you!

3

Hi,

Yes, users with vendor profiles should have at least Contributor role. This role is assigned automatically unless the vendor profile is created manually via the back-end. You don’t have to use a third-party plugin to add “edit_posts” capability for the Contributor role, as this role has it by default Roles and Capabilities – Documentation – WordPress.org

To restrict access to WordPress dashboard for regular users (including vendors), please check the Restrict access to the WordPress back-end option in HivePress > Settings > Users.

Hope this helps

1 Like
4

Hi Ihor,

thank you for helping!

I tested around again and noticed something I should tell you, that I previously forgot. I use Latepoint as an external booking plugin and had to adjust some settings, so that my vendors can have access to their dashboard. I built in an external link that redirects every vendor to their specific dashboard and when I restricted the access to WP backend in the HivePress settings, it would not work anymore. This means I cannot turn that option off, unfortunately.

Additionally, when I set up the whole website I had to add a custom code in my snippets, looking like this:

add_filter( ‘woocommerce_prevent_admin_access’, ‘latepoint_agent_admin_access’, 20, 1 );
function latepoint_agent_admin_access( $prevent_access ) {
if( current_user_can(‘edit_bookings’) || current_user_can(‘manage_latepoint’) ) $prevent_access = false;
return $prevent_access;
}

Without this snippet, the redirect to LatePoint does not work either.

Now we come to the original issue that if the capability “edit_posts” is turned on for contributors, they can delete their listings but have the described access to the backend. If turned off, they are not able to delete their own listings.

I know this is very specific but do you have any idea how to resolve this issue? I reached my limits and cannot seem to find a solution myself :frowning:
That is why I’m hoping you have a suggestion, anything is helpful! Thank you so much already for helping and taking the time to deal with this.

Best regards,
Leon

6

Unfortunately, there isn’t a simple workaround here, as this is the minimum WordPress role required for users to be assigned as authors of content (such as listings). In general, this capability alone shouldn’t expose additional dashboard menu items or grant broader access. However, in situations like this, I’d recommend disabling dashboard access entirely if possible.

If I understand correctly, the reason you need to allow dashboard access is because of a third-party booking plugin. In that case, a possible workaround would be to restrict the dashboard experience for the Contributor role by redirecting users away from unrelated admin pages and hiding all dashboard menu items except those required for the booking plugin.