Give Editor role access to delete saved form submissions

How To
1

As the title suggests I need a way to let someone with Editor role delete saved form submissions. Currently only an admin can do this. When logged in as an Editor the Bulk Actions option is not visible. Is there currently a setting for this in Bricks? Thanks!

1 Like
2

Interesting problem!
In these situation I usually go with User Role Editor plugin and just attach the capability to the role. But Bricks doesn’t have a separate capability for deleting form submissions, only to access them.

image
image526×411 10.7 KB

Instead, Bricks checks that user deleting submission has `manage_options` capability and you don’t want to attach this to your Editor as it would make them powerful as administrators.

image
image489×184 9.51 KB

We can, however, temporarily give `manage_options` capability in that specific case - when Editor is deleting form submissions.

It works now but there is no guarantee that this will work in the future because Bricks can change how they check the permission.

Here is the code:


<?php
/**
 * Plugin Name: Bricks Editor Form Delete
 * Description: Allows Editors to delete Bricks form submissions safely.
 * Version: 1.0.0
 * Author: Ivo Jerković
 * Author URI: https://ivojerkovic.com/
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

add_filter( 'map_meta_cap', function ( $caps, $cap, $user_id ) {

    if ( $cap !== 'manage_options' ) {
        return $caps;
    }

    if ( ! is_admin() ) {
        return $caps;
    }

    $user = get_userdata( $user_id );
    if ( ! $user || ! user_can( $user, 'edit_others_posts' ) ) {
        return $caps;
    }

    $page = isset( $_REQUEST['page'] )
        ? sanitize_key( wp_unslash( $_REQUEST['page'] ) )
        : '';

    $action = isset( $_REQUEST['action'] )
        ? sanitize_key( wp_unslash( $_REQUEST['action'] ) )
        : '';

    /*
    |--------------------------------------------------------------------------
    | 1. Allow UI rendering on submissions screen (GET)
    |--------------------------------------------------------------------------
    */

    if (
        $_SERVER['REQUEST_METHOD'] === 'GET' &&
        $page === 'bricks-form-submissions'
    ) {
        return array( 'exist' );
    }

    /*
    |--------------------------------------------------------------------------
    | 2. Allow actual delete action (POST)
    |   Nonce is already verified by WP_List_Table (action: bulk-submissions)
    |   and again inside Bricks handle_custom_actions().
    |--------------------------------------------------------------------------
    */

    if (
        $_SERVER['REQUEST_METHOD'] === 'POST' &&
        $page === 'bricks-form-submissions' &&
        $action === 'bricks_delete_form_entries'
    ) {
        return array( 'exist' );
    }

    /*
    |--------------------------------------------------------------------------
    | 3. Allow AJAX "delete all entries by form ID" button (POST)
    |   Nonce (bricks-nonce-admin) verified by Bricks Ajax::verify_nonce().
    |   Also requires bricks_form_submission_access capability.
    |--------------------------------------------------------------------------
    */

    if (
        $_SERVER['REQUEST_METHOD'] === 'POST' &&
        $action === 'bricks_form_submissions_delete_form_id'
    ) {
        return array( 'exist' );
    }

    return $caps;

}, 10, 3 );

also as a plugin zip file: https://demo.bytflow.com/wp-content/uploads/2026/02/bricks-editor-form-delete.zip

1 Like
3

Hi Ivo, thank you for this solution, its works perfectly.. Much appreciation!

1 Like