== System Admin ==
Contributors: mcgwier
Donate link: https://mcgwier.com
License: GPLv3 or later
License URI: http://www.gnu.org/licenses/gpl-3.0.html
Tags: sysadmin,system admin,hide menu,admin,menu,disable updates,disable update,hide plugins
Requires at least: 4.2
Tested up to: 7.1
Stable tag: 1.1

This plugin creates a new role (sysadmin), extending the admin role by offering custom privileges that enable hiding options from other users, including administrators. Does not track, does not use third-party services, is always free.

== Description ==

Extends the admin role with a new, awesomer role called 'Sysadmin'. This new role gives you a menu of options to hide menu and/or sub-menu items in the admin from all other users (e.g. Themes, Theme Editor, Plugin Editor, etc.) Very useful when restricting major changes or updates from clients or administrators.

== Installation ==

Activate, promote yourself, set your options, high five.

1. Upload `system-admin` to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Promote yourself to Sysadmin and visit System Admin on the menu, select your desired options, save changes.

== Frequently Asked Questions ==

= Is there a premium version? =

No. All that this plugin does is included in this version. Nothing hidden to be gained.

= Does this plugin add redirects? =

No. Simply hides the menu items. You can still access the direct URI (intentional fallback).

== Upgrade Notice ==

= 1.1 =
Security release. Administrators without the Sysadmin role can no longer access or change the System Admin settings. If no user has the Sysadmin role yet, use the "promote yourself" link in the admin notice after updating to regain access to the settings.

== Uninstall ==
Just deactivate and delete plugin. This will re-assign Sysadmin role as Administrator and remove all options (unhiding hidden menu items, etc.)

== Changelog ==

= 1.1 =
* Security: "Promote to Sysadmin" now requires a confirmed form submission and is only available while no sysadmin exists
* Security: System Admin settings, Plugins and Admin Menu pages are now restricted to sysadmins
* Security: Added nonce verification to all System Admin forms
* Security: "Actively prevent system admin editing" now also blocks role changes and removals, and applies to REST API requests
* Security: Fixed a bug where the edit protection could grant user-editing rights to users who did not have them
* Security: Escaped plugin names and menu titles on the settings pages
* Native WordPress success notices after saving settings, plugin visibility and menu visibility
* Saving no longer resubmits the form when the page is refreshed
* Fixed PHP 8.2+ deprecation notices

= 0.1 =
* Added readme
* Added gitignore
