Hard-coded capability for settings page

I’ve created a WordPress user role with a custom capability that allows the user to view and edit the Event Calendar settings. It’s the standard WordPress ‘Editor’ role with the addition of my new capability. The reason for doing this is that the editors need to be able to modify the “HTML before event content” section.

The Events Calendar defaults to using the pre-existing WordPress capability, manage_options for the settings page. I don’t want to give my editors the ability to change every WordPress option, so I created this custom capability.

To my delight, the Events Calendar has a hook allowing me to change this required capability: tribe_settings_req_cap. I was able to use this hook to change the capability from manage_options to my custom capability, for a specific role.

Now my editors can see the Event Calendar settings in the WordPress admin pages. All is good.

… until they try save the settings.

Yes, the Settings.php source file (in the common/src/Tribe directory) has a system in place allowing me to change the required capability for <u>VIEWING</u> the settings page, but the capability is hard-coded in the section that checks if the user can <u>SAVE</u> the settings. There is no way to modify this hard-coded capability check. There are hooks, but they don’t help.

In Settings.php, validate() method, here is the code:

if ( ! current_user_can( 'manage_options' ) ) {
  $this->errors[] = esc_html__( "You don't have permission to do that.", 'tribe-common' );
  $this->major_error = true;
}

Notice the hard-coded string literal 'manage_options'. Whereas everywhere else, it uses the $this->requiredCap property.

This is not the end of the world. I don’t need any support. It just means I have to give my editors the manage_options capability. They’ll have the ability to mess up WordPress, but hopefully that won’t happen.

But maybe you Event Calendar devs could fix this at some point? I mean, you went to all the trouble of creating this nice system allow us to change the required capability, and then you don’t actually use it.