All Users can access settings page

I looked up the code: Both the media page and the settings page use the same filter for the user capabilty:

apply_filters( ‘instant_images_user_role’, ‘upload_files’ ),

1: I don’t want to add a filter to prevent normal users from accessing a settings page (I use hundreds of plugins over different installs, i never saw this default behavior of a plugin)

2: I cant even use the provided filter, because its the same for both usage and settings of the plugin. It’s useless like this.

I’d recommend choosing the “manage_options” capability for the settings page (which is the standard in all other plugins) instead of upload_files and splitting the provided filter.

See https://www.ads-software.com/documentation/article/roles-and-capabilities/#manage_options

@pampfelimetten nice call out. The settings and image selection screens have always used the same user roles but makes sense to switch that.
thanks for the idea.

I’ve set the default role to manage_options and added new instant_images_settings_user_role hook in 5.3.1 to adjust.

thanks for the tip.

Cool, thanks!