joryhogeveen/view-admin-as

View the WordPress admin as a different role, switch between users, temporarily change your capabilities, set default screen settings for roles, manage your roles and capabilities.

View Admin As

View the WordPress admin as a different role or visitor, switch between users, temporarily change your capabilities, set default screen settings for roles.

Description

The ultimate User switcher and Role manager

This plugin will add a menu item to your admin bar where you can change your view in the WordPress admin.
Switch to other users without the need to login as that user or even switch roles and temporarily change your own capabilities.

When you're viewing as a different user, you can also change this user's preferences; like screen settings on various admin pages.

With the "Role defaults" module you can set default screen settings and metabox locations for roles and apply them to users through various bulk actions.

It also features a "Role manager" module to add, edit or remove roles and grant or deny them capabilities.

Overview / Features

• Switch between user accounts
  • Edit this user's screen preferences and settings
• Switch between roles
• Temporarily change your own capabilities (non-destructively)
• View your site as an unregistered visitor
• Switch language/locale on backend and frontend
• Make combinations of the above view types
• Easily switch back anytime
• Completely secure (see Security below)
• Do all the above without logging out!

Module: Role defaults (screen settings)

• Set default screen settings for roles
• Apply defaults to a user
• Apply defaults to all users of a role
• Apply defaults when registering a new user (in a multisite this is done when a user is added to its first blog)
• Copy defaults from one role to another (or multiple)
• Import/Export role defaults, can also download (and upload) setting files
• Disable the "screen settings" option and/or lock the meta boxes for all users that don't have access to this plugin

Click here for Role Defaults documentation

Module: Role manager (role editor)

Note: Changes made with the Role Manager are permanent!

• Add, edit or delete roles
• Grant and/or add capabilities to roles
• Rename roles
• Clone roles
• Import/Export roles, can also download (and upload) setting files
• Update role capabilities from current view
• Automatically migrate users to another role after deleting a role

Click here for Role Manager documentation

Compatibility & Integrations

This plugin will work with most other plugins but these are tested:

• Advanced Access Manager (Pro version not verified)
• bbPress
• BuddyPress
• Genesis Framework (and probably other theme frameworks)
• Gravity Forms
• Groups 2.1+ (Custom integration: adds a view type for groups. Pro version not tested)
• Pods Framework 2.0+
• Members
• Restrict User Access 0.13+ (Custom integration: adds a view type for access levels)
• User Roles and Capabilities
• User Role Editor (Pro version not verified)
• User Switching (Not sure why you'd want this but yes, switch-ception is possible!)
• WPFront User Role Editor
• WP Admin UI Customize 1.5.11+
• Yoast SEO

Full list of tested plugins and details: Compatibility & Integrations

Translations

Please help translating this plugin on translate.wordpress.org!

Actions & Filters

• Click here for Action documentation
• Click here for Filter documentation

Plugin capabilities

Click here for documentation

Ideas?

Please let me know by creating a new issue and describe your idea.
Pull Requests are very welcome!

I can't switch back!

When a view is selected there is a reset button available on the dropdown. If you get a 403 page of WordPress you can return with the link that this plugin will add to those pages. And if even that doesn't work just add "?reset-view" in the address bar and you're good to go! This will work on all pages as long as you are logged in.

Example: http://www.your.domain/wp-admin/?reset-view

It's not working! / I found a bug!

Please let me know through the support and add a plugins and themes list! :) https://wordpress.org/support/plugin/view-admin-as

Security

You have nothing to worry about.
All the plugin functionality is only run if the user is logged in AND is allowed to use this plugin (website admin or custom capabilities).
This plugin will do absolutely nothing if the above requirements are not met.

• Your view is stored separately so your user will keep the normal roles and capabilities.
• All settings, views, capabilities, etc. are verified before applied.
• Passwords are not (and cannot be) revealed.
• Fully written with the WordPress coding and security standards.
• Full support for SSL (https).

So basically if your admin users are safe, this plugin will be safe. Note: if your admin users aren't safe, this plugin is the last one to worry about ;)

Installation

Installation of this plugin works like any other plugin out there. Either:

1. Upload the zip file to the '/wp-content/plugins/' directory
2. Activate the plugin through the 'Plugins' menu in WordPress

Or search for "View Admin As" via your plugins menu.

Install as a must-use plugin

Move the view-admin-as.php file into the root of your mu-plugins directory, not in the view-admin-as subdirectory.
This is a limitation of WordPress and probably won't change soon.

Example:
All files dir: /wp-content/mu-plugins/view-admin-as/...
Main file dir: /wp-content/mu-plugins/view-admin-as.php

Minimum Requirements

• WordPress 4.1 or greater (Though I always recommend to update to the latest version!)

Developer notes

This plugin will only be useful for admins (network super admins or regular admins). It will not add functionalities for other roles unless you specifically apply custom capabilities for those users.
Also keep in mind that switching to users that have equal roles is disabled. (regular admins to regular admins + super admins to super admins)

I've created this at first for myself since I'm a developer and often need to see the outcome on roles which my clients use.

So, when you are developing a plugin or theme that does anything with roles or capabilities you can use this plugin to easily check if everything works. No more hassle of creating test users and constantly logging out and in anymore!

This plugin is also useful to support your clients and/or users. For example; make screen display presets of the edit and overview pages before you let them log in.

Other Notes

You can find me here:

• Keraweb
• Keraweb @ Slack (User keraweb)
• LinkedIn

view-admin-as's Issues

Reduce queries when getting the available users to 1

Currently there is a meta query running for every user when using the get_users() function.
This is fine for networks with a few users, but for large networks this can take a lot of time.

Todo:

• Create custom query handling for users
• Fallback to WP native function

Related #19
Related http://wordpress.stackexchange.com/questions/246589/get-multiple-users-with-meta-value-in-one-query-and-populate-wp-user-class/

Current fix:

/**
 * $WPDB_ stands for the db prefix
 */
SELECT users.*, usermeta.meta_value AS roles 
FROM {$wpdb->users} users
	INNER JOIN {$wpdb->usermeta} usermeta
		ON users.ID = usermeta.user_id
WHERE usermeta.meta_key = '{$wpdb->get_blog_prefix()}capabilities' 
ORDER BY users.display_name

Optional improvements:
Using MAX CASE we can select more meta values if needed (check compat with MySQL 5.0, WP minimum)

/**
 * $WPDB_ stands for the db prefix
 */
SELECT users.*, 
	MAX(CASE WHEN usermeta.meta_key = '{$wpdb->get_blog_prefix()}capabilities' THEN usermeta.meta_value ELSE NULL END) roles
FROM {$wpdb->users} users
	INNER JOIN {$wpdb->usermeta} usermeta
		ON users.ID = usermeta.user_id
GROUP BY users.ID
HAVING roles is not null /* $WPDB_PREFIX_capabilities meta value required, otherwise the user isn't a member of the current blog */
ORDER BY users.display_name

Automatic JS handling for simple options

Set the JS handling from the PHP side of the code to make the JS file size smaller. No need for all that duplicate code.

• Multiple value keys
• Multiple values for each key
• Confirm handling
• Required handling
• Value type processors:
  • default: get element value
  • multi: get multiple values (key -> checked)
  • selected: get selected values
• Option to parse value as json
• Option to get element attribute instead of input value

Fix page reloading with anchor tags

Remove the anchor tag before reloading

Add all existing roles from defaults to the clear list if they have been removed from WP

When defaults are applied to roles and these roles are removed the defaults still exists.
I'd like to keep it this way so the user can add the roles again and keep the defaults.
But, I'll add them to the clear roles list so the user can remove them.

Check compatibility: Awesome Support

Plugin: https://wordpress.org/plugins/awesome-support/
See: https://wordpress.org/support/topic/something-went-wrong-please-try-again/
Report:
Appears to be removing the admin bare nodes in some cases (to be reproduced).

Role Manager: Backup/Restore WP default roles

• Revert to default WP roles?
  • See wp-admin/includes/schema.php >> populate_roles()
• Icon: dashicons-vault
• Snapshot feature?

Module role defaults: UI for (de)activate meta keys

• Enable/Disable meta keys
• Add new meta keys (non-default meta keys should also be removable)

Check compatibility: Press Permit Core

https://nl.wordpress.org/plugins/press-permit-core/

Module role defaults: Import methods

• Apply (Current default: clears existing defaults and applies the new defaults)
• Overwrite (Overwrite the existing defaults, keep defaults that don't exist in the import)
• Append (Append the new imports without overwriting the existing data)

All actions are done for each role separately.

Updating role capabilities is not working on PHP version lower than 5.5

Problem with the use of boolval()
http://php.net/manual/en/function.boolval.php

Compatibility issue: We currently overwrite other user_has_cap filters.

When other plugins use the user_has_cap filter, VAA overwrites this in a view.

It might be more logical to put our filters at as first, so all other plugin's can still do their magic.
This way the filter get's actually run as if it's a different role instead of a being overwritten by view admin as.

Extra:
Maybe it's good to use the user_has_cap filter in our map_meta_cap filter as well to ensure we get the proper capability modifications from other plugins.

Fix UI when there are 20+ users grouped under a role

Scrollbar??

Also change the current user object properties on a view

Currently I only use capability mapping for the role and capability views.

• update the current user roles property (only on a role view)
• update the current user caps property
• update the current user allcaps property
• compatibility with blog switching (caused the original values to reset)

Only for capability and role views + add a filter for modules to hook into.

Check compatibility: BeaverBuilder

Adminbar isn't visible (it is rendered through)

Docs:
http://kb.wpbeaverbuilder.com/article/111-set-page-builder-editing-capabilities
http://kb.wpbeaverbuilder.com/article/439-grant-user-access-by-role-new-in-version-1-10

Compatibility: WP Customizer

Disabled for v1.6.2.

Check if there is something to do to fix reloading and capabilities. Currentlt when you switch to a different view in the customizer is reloads the regular page (non-customizer) in the iFrame or it shows a not-allowed page.

EDIT:
Fixed for v1.7.6

autoMaxHeight not working on frontend

Load the elements after window.load to make it work.

Only allow user switching for non-super admins with the `view_admin_as` capability?

Currently users that have the view_admin_as capability can also switch roles ("lower" roles) and capabilities (only their own capabilities can be selected).
I think these options are not needed for these type of users and maybe it should be removed since they likely won't be used.

The only function that I think could be handy in this case is user switching since it allows some support-like ability for higher ranking site users.

Action & Filter name consistency

Check use of action/filter prefixes

• view_admin_as everywhere for global filters
• vaa_view_admin_as everywhere for global actions
• vaa_admin_bar Toolbar related actions & filters
• _view_admin_as for internal filters not to be used outside of the plugin
• _vaa_view_admin_as for internal actions not to be used outside of the plugin

Enforce role defaults

Option to not just hide the screen options for users but enforce the set role defaults even if the user has set his/her own preferences.

Role Manager: Export/Import roles

All JSON format

• Option to export all roles or a single role
  • Only export non-translated data (role ID/slug => capabilities)
• Option to import a single (new or existing) role only
• Option to export/import the capabilities only (with role selector)

Better icon handling

Remove icon definitions from CSS and move them to PHP
Creates more flexibility and streamlined CSS.

Add switch links in user management page

Can be handy with a large number of users (customers in a webshop for example)

• Add links (no JS)
• Redirect to dashboard

Update screenshots v1.7

Performance with 1000+ users >> AJAX user search

The plugin runs fine with a lot of users but when other plugins hook into the user capabilities with queries the load time can still be affected heavily.

The options/features below should fix this:

1. Limit user query to a max of 100 results. This can be changed with the filter: view_admin_as_user_query_limit
2. When there are more users than the limit (default: 100), switch to AJAX search instead of loading all users.
3. Option to disable the user view type UI. It is then still possible to switch from the user lists page. #84

Log:

Run tests on a blog with a LOT of users

• 100+ works good! Hardly noticeable
• 500+ works good! Hardly noticeable
• 5000+ @planetahuevo reported errors using membership plugins.

Module: User Access Manager plugin support

Just like with Restrict User Access #31 and Groups #11 . Also support this plugin.

Since the viewtype name will be similar to that if "Groups". Let's add a plugin name description for each additional view type module.

Let is_super_admin() return false when a role/caps view is selected

When a role or capability view is selected the current user is still the same. So if any plugins only validate a is_super_admin() check instead of current_user_can() these checks would return true.

Not 100% sure but I'd say that when a view is selected, is_super_admin() should return false.

• Maybe make it optional??
• Only disable on non-network admin pages

Tests:
This effectively disables functions grant_super_admin() and revoke_super_admin() since it sets/changes the $super_admins global variable. So when you switch to another super admin (as a superior admin) adding other users to the super admin list should not work.

Configure CodeClimate

• Enable FIXME (no config)
• Enable & Configure Duplication
• Enable & Configure PHP Code Sniffer
  • Create separate config file like phpmd? (No support on CC, only local)
• Enable PHP Mess Detector
  • Configure PHP Mess Detector: master/tests/phpmd.xml
  • dev/tests/phpmd.xml
    • Is NPath complexity of 200 too low?
      • Suppress docs added where needed
    • Is Cyclomatic complexity of 10 too low?
      • Suppress docs added where needed
• Enable CSSLint
  • Configure CSSLint: dev/tests/.csslintrc << not supported, config done in dev/.codeclimate.yml)
    • Disable !important error (I need it for admin bar changes)
• Enable ESLint (dev)
  • Configure ESLint dev/tests/.eslintrc
    • Yoda! :)
    • Is Cyclomatic complexity of 6 too low? (yes >> 12 is ok)
    • allow semicolon at the beginning (inline comment fix)

Configure Scruntinizer

• Link with GitHub
• Fix build config (or disable since I also use Travis CI)
• Fix style (or disable since I also use CodeClimate)

Superior admin filter was not working for single installations

See: https://wordpress.org/support/topic/need-to-switch-to-another-admin/

Issue is with VAA_API::is_superior_admin() when $user_id parameter is null.

Add new network capabilities WP 4.8

https://make.wordpress.org/core/2017/05/22/multisite-focused-changes-in-4-8/

Responsive usage

• Enable admin-bar icon on responsive views
• Fix UI
• Fix JS events
• Fix a11y

Note:
Mobile screens are not wide enough to show all adminbar icons so this could cause the item to alread on a second line when there are more plugins active.
WP should fix this in core.

Visitor view (no capabilities other than view the front-end)

• Consider: is a visitor a role or a new view type? >> Yes
• Testing!

Immobilize metaboxes setting (Role defaults)

Prevent non-vaa users to move metaboxes when this setting is enabled

Better admin bar handling when set to hidden by user

Network views for superior admins

Add view options at network pages when view_admin_as_superior_admins filter is used

Check usage of BuddyPress capabilities

Added in 1.7.1:

• bp_moderate
• bp_xprofile_change_field_visibility

Todo
Other capabilities found in BuddyPress plugin:

• throttle
• keep_gate
• moderate_comments
• edit_cover_image
• edit_avatar
• edit_favorites
• edit_favorites_of
• add_tag_to
• edit_tag_by_on
• change_user_password
• moderate
• browse_deleted
• view_by_ip
• write_posts
• write_topic
• write_topics
• move_topic
• stick_topic
• close_topic
• edit_topic
• delete_topic
• delete_forum
• manage_forums
• manage_tags

Module Role Defaults: Copy defaults from role to role

Similar to import except take an existing role source and use it to overwrite/append/import into other roles.

Role Manager: Rename role

• Option to change the label of a role. (v1.7.1)
• Maybe also option to change the slug? (for non-default roles)
  • Would be a shortcut to clone a role and remove the "old" role.
  • Should also update users with that role to the new role.

Check compatibility: Advanced Access Manager Pro

https://wordpress.org/plugins/advanced-access-manager/screenshots/

• Basic (free) functions seem to work with latest dev (#29)
• Pro functions?

Module: Role Manager

Add or remove roles and grant or deny them capabilities.

• Add / remove roles
• Clone roles
• Grant capabilities to roles
• Add new capabilities (to roles)
• Apply current view capabilities to role
• Testing! #42

Use cookies instead of user meta?

I currently use the user meta to set/get view data.

• Check pros/cons for using cookies.

Tooltip help UI

Optional replacement for option descriptions.

View combinations

Ability to create view combinations.

Example:

• User view: "Joe" (default role: Author)
• Modify Joe's role with the Role view to "Editor"
• And as a third layer: grant or deny capabilities to the above combination with the Caps view.

Would result in a view based on user "Joe" with role "Editor" and extra capability modifications.

Todo:

• Apply conditions on the number of active views on various locations (v1.6.3)
• View combinations working in the core code (v1.7)
• UI (v1.8)

Module: Restrict User Access plugin support

https://wordpress.org/plugins/restrict-user-access/

Branche: Currently only local dev
Related: intoxstudio/restrict-user-access#8

Status/Tests:
Only access level view:

• Admin capabilities
• Frontend: restrict posttype
• Frontend: restrict menu item
• Frontend: shortcodes

Access level view in combination with a role view

• Admin capabilities
• Frontend: restrict posttype
• Frontend: restrict menu item
• Frontend: shortcodes

Allow user search on ID aswell when they are grouped

• Search by user ID
• Show user ID in results

Module: Groups plugin support

Optionally support the Groups plugin if active.
See: https://github.com/itthinx/groups
Documentation: http://docs.itthinx.com/document/groups/

Can be improved with: itthinx/groups#59

VAA 1.7.2 - Initial PR: #59
Currently only supports features from the free version of Groups.

• groups_user_can & groups_group_can (though not really usefull when you are a super admin, use case possible with view combinations: #18)
• groups shortcodes
  • Custom shortcode implementation for groups_member & groups_non_member
• Page restrictions
  • I Replicate a 404 page when the selected user has no access to read. I use this since I can't hook into the posts_where filter from Groups.

Future

• More?

Better handling for permission errors

Currently I add a simple test with a link to reset the view when there is a permission error.
Note, I only handle errors when a view is selected!

Enhance this to:

• Give some more info on the error (if possible)
• Add a link to the dashboard aswell (without resetting the view)
• Add a link to the front page aswell (without resetting the view)

Check compatibility: WP Admin UI Customize

Plugin: https://nl.wordpress.org/plugins/wp-admin-ui-customize/
See: https://wordpress.org/support/topic/something-went-wrong-please-try-again/
Report:
Unable to switch back to default view

See: WAUC/#1 & WAUC/#2

Create PHP Unit test

• Login tests (Controller: auto reset and expire)
• User capability tests
  • Access VAA (check if the main plugin is enabled)
• Store tests (check available users, roles and capabilities per user role)
• View data tests
• Setting tests
• did_action tests
• API tests
  • Basic helper functions tests
• Modules
  • Role Defaults
    • Setting meta keys
    • Meta key compare
    • Import/Export role defaults
    • Copy role defaults
    • Clear role defaults
  • Role Manager
    • Role name/slug sanitizing
    • Export/Import roles
    • Clone roles
    • Rename roles
    • Delete roles

Setting: Freeze locale

Force your own locale setting over that of a selected view.

Available since WP 4.7

• Build functionality
• Validate WP version for option display

https://make.wordpress.org/core/2016/11/07/user-admin-languages-and-locale-switching-in-4-7/