I love my friends, but I wouldn’t trust most of them with a loaded weapon. Similarly, I want to give my editors the ability to approve new users in a closed WordPress forum I set up for one of our clients, but I don’t want to give editors all of the functionality that comes with the manage_options Capability.

I’m using the Absolute Privacy plugin for WordPress, which I’ve slowly been modifying myself, so it’s the one plug-in I’ve set to version 999 to ensure that it doesn’t get accidentally overridden by an overzealous admin (read: me). This means it’s also the one plugin I’ve been playing around with deeply.

By default, Absolute Privacy tests against the manage_options Capability flag to see if you should have permission to moderate new users. I don’t want to give my editors the ability to manage all WordPress options, so I did the following:

1. In Users->Roles, I added a new capability called approve_new_users, and gave Administrators and Editors the capability.
2. Then I went into the code for Absolute Privacy and found the function that creates the Moderate Users menu item. I edited two lines of code:
   • I replaced the line that tests the user’s Capability to read
     if (!current_user_can('approve_new_users'))
   • I edited the add_submenu_page call to read
     add_submenu_page('users.php', 'Moderate Users', 'Moderate Users', 'approve_new_users', basename(__FILE__), array(&$this,'moderateUsers'));

Done!

• Absolute Privacy – I played around with a LOT of user moderation tools before settling on this one, with a few modifications, which I’ll talk about in a separate post. Absolute Privacy gives you the ability to ask for a first and last name during registration, set a password upfront (no emailing passwords), review and approve new users, force redirects for unregistered users (nicer than password-restricting the site using .htaccess), manage access to RSS feeds, and most importantly, edit all the confirmation emails new users get, something sorely missing in WordPress by default, and not handled well by other access management plugins. Simply put: spectacular!
• BM Custom Login – This is what I used to redesign the look of the registration window, which keeps getting longer and longer as I add more fields! It’s nicely extensible, and plays well with all my plugins.
• Cimy User Extra Fields – While this is definitely one of the more complicated and difficult-to-use plugins I’ve worked with, it’s also one of the most extensible, so for that reason I hold onto it. I use this plugin to add extra fields that allow the administrators and editors to make a call as to whether to allow the user to join the community or not. I haven’t gotten around to editing the Absolute Privacy’s Moderate Users screen to display the extra info (note to self), but if the moderator clicks on the profile link, they’ll see all the fields and can then go back and approve or deny the addition.
• Members – I use this to give me more capability to manage roles and, well, capabilities.
• Members List – This allows me to create a public, searchable listing of members. I can easily edit how the list appears, and what it links to.
• Register Plus – It’s a crying shame that the developer has stopped making updates to this plug-in, as it looks like it could handle so much of what I want inside one plugin, but alas, most of it is broken. I still use it to display and manage the Terms of Service and other Disclaimers for the site, as well as to permit the use of multiple logins with the same email address (mostly for testing purposes). There are a TON of other features, but many of them don’t seem to work any longer.

I’ll share some other plugins that I’m using to encourage user activity, but this is a great combination that provides me with some peace-of-mind.