Restrict role from updating or deleting specific navigation menus

chadlol

Hi,

Is there any way to create an access policy to deny the role the ability to update or delete specific menu items from menu structure editor on the Appearance>Menus page? I would simply deny access to the menus page, but I still need to grant the role access to the menus page, and the ability to edit menus, but only ones they are allowed access to.

Here's what my access policy currently looks like. Obviously, it's not working.

{
    "Version": "1.0.0",
    "Dependency": {
        "wordpress": ">=5.0.3",
        "advanced-access-manager": ">=5.8.2"
    },
    "Statement": [
        {
          "Effect": "deny",
          "Resource": "Menu:584",
          "Action": "AAM:update"
        }
    ]
}

vasyl

chadlol fantastic question and you are absolutely right - the policy that you've defined will not work for several reasons. My assumption would be that you just wanted to show sorta pseudo-definition of the desired policy.

There are two news for you. The bad news is that currently AAM does not have the ability to manage the list of "menus" on the Appearance->Menus page. However the good news is that I was able to adjust AAM core to support this functionality. You can download the dev version from here.

So here is how you can define your policy. Any menu that you build on the Appearance->Menus page is a combination of post types (Post, Page, Product etc), hierarchical taxonomies (Category, Media Category etc) and custom links.

A lot of times, people think that menu items are something special in WordPress however inside the WordPress core they all are stored as posts inside the wp_posts database table.

So you main objective would be to hide posts or terms that you do not want your users to see on the Appearance->Menus page. AAM already has the option LIST that can be used to hide unnecessary/unwanted posts and terms. Recently I also added the ability to manage access to posts & terms with Access Policies.

The tricky part of all this is that you want to hide specific menu items on the Appearance->Menus page and allow to see them on any other pages of your site. Luckily, you can do that with Statement Conditions (just make sure that you downloaded and installed dev version that I've mentioned above as it introduces the SERVER marker).

So for example, lets assume that you have two pages About (permalink - about) and Calendar (permalink - calendar), post with ID 9285 and Category News (slug - news). You do not want some user or group of user to be able to select them on the Appearance->Menus. Here is the way the policy may look like:

{
    "Version": "1.0.0",
    "Dependency": {
        "wordpress": ">=5.0.3",
        "advanced-access-manager": ">=5.8.2"
    },
    "Statement": [
        {
            "Effect": "deny",
            "Resource": [
                "Post:page:about",
                "Post:page:calendar",
                "Post:post:9285",
                "Term:category:news"
            ],
            "Action": "List",
            "Condition": {
                "Equals": {
                    "${SERVER.PHP_SELF}": "/wp-admin/nav-menus.php"
                }
            }
        }
    ]
}