unable to remove admin menu items after using pods_is_admin

[SethTurin]

I've killed a few days on this now. Please help!

Issue Overview

I'm using Wordpress multisite. After applying the suggestion from #1629, the menu shows up as expected. However, I'd like to remove admin abilities to change components and templates, since this presents a security risk.

my first step is to remove the menu items with

    remove_submenu_page('pods', 'pods-components');
    remove_submenu_page('pods', 'edit.php?post_type=_pods_template');

This code works fine if I'm a super admin and I don't have the pods_is_admin code running. But as soon as I add the pods_is_admin code (the fix from #1629), the menu items reappear, and I haven't found any way to get rid of them.

Of course, after I get rid of them, I also need to restrict access to the pages themselves (since removing the menu items doesn't do this). The security risk still exists because the user can manually type in the url. Interestingly, despite the menu item for templates being shown, by default, the site admin is unable to access the templates page. I'm not sure if this is expected behavior, since the menu item is shown, but it is the desired behavior, assuming I can kill the menu item.

That just leaves the components page to remove. I looked for capabilities I could set to remove this, but didn't find any. Is there any other simple way to remove site admin access to this page?

Expected Behavior

1. menu items should be removed when using remove_submenu_page on pods submenus
2. need a way to restrict access to components page once the menu item is removed

Current Behavior

1. menu items are shown even after being removed
2. admins already do not have access to templates page, but they do have access to components page

Steps to Reproduce (for bugs)

For the menu item removal behavior, you should be able to reproduce it with the code below. This is on a multisite installation, and the code is placed in the functions.php of the default theme.

add_filter( 'pods_is_admin', 'slug_let_admins_admin', 10, 3 );
function slug_let_admins_admin( $has_access, $cap, $capability ) {
	$capability = 'admin';
	return $capability;
}
function custom_remove_admin_menus (){
    remove_submenu_page('pods', 'pods-components'); //pods components
    remove_submenu_page('pods', 'edit.php?post_type=_pods_template'); //pods templates

    return true;
}
add_action('admin_menu', 'custom_remove_admin_menus', 999);

Related Issues and/or PRs

#1629

WordPress Environment

``` Debug Information WordPress Version: 4.9.4

PHP Version: 7.0.28

MySQL Version: 5.6.36

Server Software: Apache

Your User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36

Session Save Path:

Session Save Path Exists: No

Session Save Path Writeable: No

Session Max Lifetime: 1440

Opcode Cache:

Apc: No
Memcached: No
OPcache: Yes
Redis: No
Object Cache:

APC: No
APCu: No
Memcache: No
Memcached: Yes
Redis: No
WPDB Prefix: wpta_

WP Multisite Mode: Yes

WP Memory Limit: 128M

Pods Network-Wide Activated: Yes

Pods Install Location: /home/moneymac/public_html/appjaq.com/wp-content/plugins/pods/

Pods Tableless Mode Activated: No

Pods Light Mode Activated: No

Currently Active Theme: NT Antique Child

Currently Active Plugins:

ActiveCampaign: 6.2.12
Breadcrumb NavXT: 6.0.4
Contact Form 7: 5.0.1
Dashboard Widgets Order: 2.0.4.2
Defender Pro: 1.7.5
Envato Market: 1.0.0-RC2
Front Page Custom Post Type: 1.0
Hummingbird Pro: 1.8.0.4
Jetpack by WordPress.com: 5.9
Join My Multisite: 1.8
Maps Builder: 2.1.2
Meta Box: 4.14.0
Meta Box Show Hide: 1.0.2
NT Antique Shortcodes: 1.1.3
OptionTree: 2.6.0
Page Links To: 2.9.10
Pods - Custom Content Types and Fields: 2.7.1
Portfolio Post Type: 0.9.3
Post Indexer: 3.0.6.4
Price Manager: 0.9.1
Reader: 1.2.6
Sassy Social Share: 3.1.10
Slider Revolution: 5.4.6.6
Snapshot Pro: 3.1.5
Theme My Login: 6.4.10
Ultimate Member: 1.3.88
User Role Editor: 4.40.1
WordPress Importer: 0.6.4
WPBakery Page Builder: 5.4.5
WPMU DEV Dashboard: 4.4
WPMU DEV Videos: 1.5.5
WP Smush Pro: 2.7.8

</details>

[quasel]

Okay I think the title is misleading! You want them to have access to edit pods - but block their access to the component settings and pods templates? That's a question for @sc0ttkclark

and from looking at your code I don't think that will work as expected, because the filter just expects true or false! so basically you always say "yes" as for an IF check everything that's no FALSE (an similar) is interpreted as true!

maybe more information #2311, #3985