I have a simple redirect function in a custom plugin to prevent users from accessing WP Admin area in a multi-site installation.

The plugin enables users manage contents and their profile at the front-end and gives access to uploading via WP Media Uploader.

While all works well, once I have the said redirect function active, users without the given capability can no longer see the images when the Media Uploader launches.

Here is the redirect function with the given capability:

function my_noAdminAccess(){
    if( !current_user_can( 'delete_others_posts' ) ){
        if( wp_get_referer() ){
            exit( wp_safe_redirect( wp_get_referer() ) );
        }else{
            exit( wp_safe_redirect( site_url('/') ) );
        }
    }
}
add_action( 'admin_init', 'my_noAdminAccess', 100 );

I need the function active but how can it work without affecting the Media Uploader images?

I have a simple redirect function in a custom plugin to prevent users from accessing WP Admin area in a multi-site installation.

The plugin enables users manage contents and their profile at the front-end and gives access to uploading via WP Media Uploader.

While all works well, once I have the said redirect function active, users without the given capability can no longer see the images when the Media Uploader launches.

Here is the redirect function with the given capability:

function my_noAdminAccess(){
    if( !current_user_can( 'delete_others_posts' ) ){
        if( wp_get_referer() ){
            exit( wp_safe_redirect( wp_get_referer() ) );
        }else{
            exit( wp_safe_redirect( site_url('/') ) );
        }
    }
}
add_action( 'admin_init', 'my_noAdminAccess', 100 );

I need the function active but how can it work without affecting the Media Uploader images?

• multisite
• redirect
• wp-redirect

1 Answer 1

For anyone who this might help, I found a working solution. Redirecting is working and users can see their images at the front-end WP Media Uploader.

function my_noAdminAccess(){
if ( is_admin() && ! current_user_can( 'delete_others_posts' ) && ! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) ){
    if( wp_get_referer() ){
        wp_safe_redirect( wp_get_referer() );
        }
    else{
        wp_safe_redirect( site_url('/') );
        }
    exit;
    }
}
add_action( 'admin_init', 'my_noAdminAccess', 100 );