Security¶

Barberklingen\BasePlugin\Modules\Security\SecurityLoader

Manages custom WordPress roles with granular WooCommerce capabilities and locks down admin areas to specific roles. Also disables XML-RPC completely.

Activating the module¶

SecurityLoader::get_instance();

Roles¶

Custom roles are defined under Modules\Security\Roles\. Each role extends UserRole and declares its capabilities by composing static capability helpers:

The slug is derived from the role name with sanitize_title(), so spaces become dashes.

Growth role¶

Growth is the content and campaign role, so it owns pages and products:

• Products — create, edit and publish WooCommerce products, including product categories and tags. WooCommerceCaps::publish_products() is a separate group, so roles that only get edit_products() can prepare drafts but not publish them.
• Pages — full page access, which also covers Happy Elementor Addons' Happy Clone. Happy Clone checks edit_posts plus edit_post on the page being cloned; it needs no capability of its own.

Role structure¶

class MyCustomRole extends UserRole {
    public static function name(): string {
        return 'My Custom Role';
    }

    public static function capabilities(): array {
        return [
            DashboardCaps::read(),
            WooCommerceCaps::base(),
            WooCommerceCaps::view_orders(),
            WooCommerceCaps::edit_orders(),
        ];
    }

    public static function editable_roles(): array {
        return ['customer']; // roles this user can edit
    }
}

Happy Clone¶

HappyCloneArea lets Growth clone pages written by other users.

Happy Elementor Addons refuses to clone a draft, private or password protected item unless the current user is its author — published pages are never affected. The addon has no filter for that check, so the area wraps the addon's own handler and relaxes it for the single post being cloned.

It only does so when all of the following hold:

• the request carries a valid ha_duplicate_thing nonce,
• the user has edit_post for that post, and
• the user is in an allowed role.

Allowed roles default to growth and administrator:

add_filter( 'security/happy-clone/allowed-roles', function ( array $roles ) {
    $roles[] = 'customer-service-team-leader';

    return $roles;
} );

Capability groups¶

Capabilities are grouped into composable static helper classes:

Areas¶

AreasLoader boots area-specific access rules. Areas represent sections of the WordPress admin that are opened up or locked down for specific roles:

XML-RPC¶

XML-RPC is disabled unconditionally when SecurityLoader is active:

add_filter('xmlrpc_enabled', '__return_false', 9999);
add_filter('xmlrpc_methods', '__return_empty_array', 9999);

WP-CLI¶

wp security setup

Registers all custom roles and their capabilities in the database. Run after deploying role changes.