Users connected with the "subscriber" role in WordPress do not see CiviCRM nor access to it (404 error). It works well with WP admin role. I believe I have configured correctly the permissions in Administer -> Users & Permissions -> WordPress Access Control. Any ideas? Many thanks
6
-
Can you check if the url doesn't have wp-admin/admin.php?– Pradeep NayakCommented Aug 9, 2019 at 10:48
-
What version of CiviCRM are you using? And did it work until you did an update?– Jon G - Megaphone TechCommented Aug 9, 2019 at 16:20
-
2Also, you said "I believe I have configured correctly the permissions" - can you please edit your question to tell us (and/or use a screenshot) to show us the permissions?– Jon G - Megaphone TechCommented Aug 9, 2019 at 16:24
-
@ Pradeep: as told in my question, admin role can access CiviCRM so admin.php is there @ Jon: I use version Version 5.14.1, first version installed (I will update it on the next days) I have configured correctly the permissions in Administer -> Users & Permissions -> WordPress Access Control as you can see: !Valid XHTML.– PatrickCommented Aug 12, 2019 at 16:07
-
Could you clarify what level of access you want subscribers to have? This isn't clear from your question.– William MortadaCommented Sep 22, 2019 at 10:56
|
Show 1 more comment
1 Answer
After having tested all the possibilities by checking and unchecking all the options marked in the WordPress Access Control pane, I found that the box "CiviCRM: access CiviCRM backend and API" must be be ticked. Otherwise you dont have access to CiviCRM. Strange because it is told to give this to trusted roles only. The well done documentation is unfortunately lacking on this subject.
-
I wouldn't normally recommend giving subscribers this level of access to CiviCRM. What do you want subscribers to be be able to do on your site? You can find the documentation here: docs.civicrm.org/user/en/latest/initial-set-up/… Commented Sep 22, 2019 at 10:55
-
1The subscriber should be able to do what a "normal user" can do in a NP organisation : create, modify, delete and use contacts.– PatrickCommented Sep 23, 2019 at 9:37
-
The 'subscriber' role in WordPress is typically used to allow people to sign up to receive information from a website. It doesn't normally give them permission to access any admin functions or the WordPress dashboard. Perhaps you are using this role in a different way but it sounds like an unusual set up. As it says in the manual the permission to access the CiviCRM back end should only be given to trusted roles and I wouldn't recommend giving it to anyone outside the staff team. Commented Sep 23, 2019 at 10:06
-
If you are using the role for staff I would be inclined to use one of the other WordPress roles that typically have greater access such as 'administrator' or 'editor'. Alternatively you could create a new role for this purpose. This page that explains roles and permissions may help: wordpress.org/support/article/roles-and-capabilities Commented Sep 23, 2019 at 10:10
-
Thank you William, I fully understand what you mean, but... this doesn't explain why I need to give the " "CiviCRM: access CiviCRM backend and API" to see CiviCRM menu. The problem will be the same with all other roles... According me, this is a weakness in the security of CiviCRM under WP.– PatrickCommented Sep 23, 2019 at 15:13