Site-level activation on WP Multisite allows network users access

  • Resolved nathanegraham

    (@nathanegraham)


    8 years, 12 months ago

    Hi Kevin,

    Great plugin. I have a multisite network where I enable Force Login on a few sites on the network (instead of Network Activate). In my tests just now I was able to access sites as a logged in Network-level user who isn’t actually registered to that particular site. In other words, when Force Login is activated on a site by site basis on a multisite, it functions like “Any logged-in user on the network can access” instead of “Only registered users on this site on the network can access.”

    Thanks,
    Nathan

    https://www.ads-software.com/plugins/wp-force-login/

Viewing 10 replies - 1 through 10 (of 10 total)
  • Plugin Author Kevin Vess

    (@kevinvess)

    Ah, yes, I believe you’re correct.

    The way users work in a multisite setup is that there is a single pool of users, who are then associated with sub-sites. So, logged-in status is common across all the sites.

    There is a way to check if the current user is a member of the specified site. I’ll see about adding this in for a new release.

    Thanks!

    Plugin Author Kevin Vess

    (@kevinvess)

    I just released a new version (4.0) that should address this issue. Let me know if you have any further problems. Thanks!

    Be sure to rate and review my plugin to let others know how you like it; enjoy!

    Thanks, Kevin! I’ll add a review now.

    I’m not completely on board with that change but glad I found this documented here. I have myself as a roving super admin not attached to any one site. I updated the plugin and couldn’t access anything. I then had to remote in and ‘delete’ the plugin to get back in. Looks like I’ll need to add myself to those blogs where we are using this plugin.

    Plugin Author Kevin Vess

    (@kevinvess)

    @doo_it
    I’m sorry you ran into that issue while updating; I hadn’t considered there would be users without assigned sites.

    However, I can fix it so this new change doesn’t affect ‘Super Admin’ users –?which would make sense, considering that user role has access to the site network administration features.

    Thanks for letting me know!

    Interesting. This doesn’t seem possible though? I’ll have to test this later but the network admin can access any site without logging in. Seems like an issue for wp core if it’s possible to lock the network admin out of sites on the network with a plugin.

    I was also able to replicate this issue where logged in network admin gets a message that they do not have permission to the site when the plugin is active. A way to get around this is to add yourself to the site through the network admin dashboard, which, of course, isn’t ideal if you have a lot of sites with the plugin active.

    Plugin Author Kevin Vess

    (@kevinvess)

    I just released a new version (4.1) which should address this issue. ‘Super Admin’ users are not required to have assigned sites in order to access any site in the network.

    Let me know if you all run into any other issues with this. Thanks!

    Thank you for the quick update everything is working great for me!

    I just tested as well and it works great for me, too. Thanks!

Viewing 10 replies - 1 through 10 (of 10 total)
  • The topic ‘Site-level activation on WP Multisite allows network users access’ is closed to new replies.