我试图在wordpress多站点环境中创建自定义角色。这个角色的功能与管理员相同,但也可以像超级管理员一样提交未过滤的HTML。我成功地创建了角色并将unfiltered\\u html设置为true,但文本编辑器仍然会剥离iframe和其他html元素。下面是我命名为“开发者”的新角色的PHP代码。
function add_developer()
{
//remove role if it already exists
if( get_role(\'developer\') ){
remove_role( \'developer\' );
}
//custom user role for unfiltered_html
$result = add_role(\'developer\', __(\'Developer\' ),
array(
\'read\' => true,
\'activate_plugins\' => true,
\'delete_others_pages\' => true,
\'delete_others_posts\' => true,
\'delete_pages\' => true,
\'delete_posts\' => true,
\'delete_private_pages\' => true,
\'delete_private_posts\' => true,
\'delete_published_pages\' => true,
\'delete_published_posts\' => true,
\'edit_dashboard\' => true,
\'edit_others_pages\' => true,
\'edit_others_posts\' => true,
\'edit_pages\' => true,
\'edit_posts\' => true,
\'edit_private_pages\' => true,
\'edit_private_posts\' => true,
\'edit_published_pages\' => true,
\'edit_published_posts\' => true,
\'edit_theme_options\' => true,
\'export\' => true,
\'import\' => true,
\'list_users\' => true,
\'manage_categories\' => true,
\'manage_links\' => true,
\'manage_options\' => true,
\'manage_comments\' => true,
\'promote_users\' => true,
\'publish_pages\' => true,
\'publish_posts\' => true,
\'read_private_pages\' => true,
\'read_private_posts\' => true,
\'remove_users\' => true,
\'switch_themes\' => true,
\'upload_files\' => true,
\'unfiltered_html\' => true
)
);
if ( null !== $result ) {
echo \'Yay! New role created!\';
}
else {
echo \'Oh... the basic_contributor role already exists.\';
}
}
我正在一个团队中工作,以转换一个有数千页的大型网站,并希望避免给每个人超级管理员访问权限。我是否可以避免只针对特定用户角色使用html过滤器?如果没有,是否可以为特定用户执行此操作?我想避免改变核心,不介意删除所有过滤。我目前正在我的函数中测试这一点。我的主题的php文件,但最终将为此编写一个插件。
我知道,由于用户能够发布javascript,将存在安全风险,但如果我们不必明确授予整个团队超级管理员访问权限,我的团队愿意接受这种风险。
非常感谢您的帮助!