How to prevent a user from deleting and editing media files?

  • Resolved Bence

    (@charybdis)


    3 years, 7 months ago

    Hi,
    I would like to configure that a contributor user can upload new media files, but this contributor user cannot edit the media files (including his/her own files), and this contributor user cannot delete media files (including his/her own files), but it does’t work.

    I installed both the PublishPress Capabilities Free and PublishPress Permissions Free plugins.

    I use WordPress 5.8 and PHP 7.4, latest versions of the plugins and I don’t have any other plugins installed, only these two plugins.

    Here is the screenshot of my capabilities page:

    View post on imgur.com

    You don’t see on the screenshots, but the edit own attachments permission is also negated.

    And in the PublishPress Permissions plugin I have checked the “Enforce distinct edit, delete capability requirements for Media” option ,and I have unchecked the “Users can always edit their own attachments”.

    I saved these settings and yes, there is a user assigned to the contributor role.

    Then I login with that contributor user and no matter what I do, this contributor user will be able to delete the own media files (specifically images).

    So everything works, except the fact that this contributor users is still able to delete his/her own media files.

    But as you can see, I explicitly negated the permission to delete media files, so how is it possible?

    • This topic was modified 3 years, 7 months ago by Bence.
Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Author Steve Burge

    (@stevejburge)

    Hi @charybdis

    Thanks for using PublishPress.

    Please follow this guide to control deleting media files:
    https://publishpress.com/blog/delete-media-files-wordpress/

    Thread Starter Bence

    (@charybdis)

    Hi,
    yes I have already read and followed that article, but my problem is still the same:

    I want to configure that a contributor user should be able to upload media files (it works), but then this user should not be able to edit that file (it works works) and I want to also disable the “delete permanently” button for a media file, even if the contributor user himself uploaded that media file.

    And here comes my problem, no matter what I do, the contributor use will always be able to delete his own media files.

    So a contributor user cannot delete other media files, only his/her own media files.

    But I want to ensure that a contributor user cannot delete any media files, including his/her own media files.

    So I have already read that linked article.

    That article says:

    By default, only users in the “Administrator” role are able to delete images and files in WordPress.

    Users in the Subscriber, Contributor, Author and Editor roles are not allowed to delete.

    But actually it is not true. Users can delete their own media files by default.

    Could you please take a look at my settings I shared in my initial post?

    As you can see, I explicitely set the option to disable the ability to delete media files, but when I login with my contributor test user, that contributor user can still delete the own media files, how is it possible?

    Is it even possible with the plugin to disable the deletion of own media files?

    Thread Starter Bence

    (@charybdis)

    I followed that guide exactly, but a contributor user can still delete his/her own media files. could you please take a look at my settings I shared in my initial post?

    Thread Starter Bence

    (@charybdis)

    I did a fresh install of WordPress 5.8 with PHP 7.4, using the latest versions of PublishPress Capabilities Free and PublishPress Permissions Free plugins. I only have these two plugins installed with the default WordPress theme. This is a fresh install, the database is fresh, too.

    Could you please take a look at my settings? https://imgur.com/a/GvKXrE4

    I have created a contributor user. I made sure that I actually saved these settings into the database.

    Now I have the following issues:

    As you can see, a contributor user should be able to upload media, but then this contributor users should not be able to edit or delete the uploaded media, right?

    However in reality when I login with the contributor user, then that user can still edit and/or delete the own media files.

    Isn’t it a bug in your plugins, and is it actually possible to forbid a contributor user to delete his/her own media files?

    I followed your documentation and your linked article to the letter.

    Thread Starter Bence

    (@charybdis)

    I think this is a bug, please don’t mark this thread as resolved, because it is not resolved yet.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘How to prevent a user from deleting and editing media files?’ is closed to new replies.