Changeset 61687 for trunk/src/wp-admin/options-general.php

Timestamp:

02/19/2026 09:42:59 AM (3 months ago)

Author:

audrasjb

Message:

Administration: Warn when open registration and new user default is privileged.

Previously, WordPress allowed site owners to open registration AND to set the default new user level to "Administrator" or "Editor". While this combination may make sense for some sites, this is genrally a really really bad idea.

With this changeset:

• Administrator and Editor roles are now removed from the new user default role selector in the General Options admin screen.
• If such a role was selected before, an alert is shown in Site Health.
• A new filter is introduced: default_role_dropdown_excluded_roles allows developers to change the default excluded roles in the dropdown.

Props kraftbj, subrataemfluence, roytanck, dd32, ottok, jrf, eatingrules, verygoode, generosus, stevejburge, arunu1996, benniledl, audrasjb, mukesh27, swissspidy, Mte90, zodiac1978, pooja1210, davidbaumwald, johnbillion, jorbin, SirLouen, oglekler, kirasong, shailu25, huzaifaalmesbah, jsmansart.
Fixes #43936.

File:

• trunk/src/wp-admin/options-general.php (modified) (1 diff)

trunk/src/wp-admin/options-general.php

@@ -305 +305 @@
 <th scope="row"><label for="default_role"><?php _e( 'New User Default Role' ); ?></label></th>
 <td>
-<select name="default_role" id="default_role"><?php wp_dropdown_roles( get_option( 'default_role' ) ); ?></select>
+    <?php
+    /**
+     * Filters the roles to be excluded from the default_role option.
+     *
+     * @since 7.0.0
+     *
+     * @param string[] $roles_to_exclude Array of roles to exclude from the dropdown.
+     *                                   Defaults to administrator and editor.
+     */
+    $excluded_roles = (array) apply_filters( 'default_role_dropdown_excluded_roles', array( 'administrator', 'editor' ) );
+
+    $editable_roles = array_reverse( get_editable_roles() );
+
+    $selected = get_option( 'default_role' );
+
+    foreach ( $editable_roles as $role => $details ) {
+        if ( in_array( $role, $excluded_roles, true ) && $role !== $selected ) {
+            unset( $editable_roles[ $role ] );
+        }
+    }
+    ?>
+    <select name="default_role" id="default_role"><?php wp_dropdown_roles( $selected, $editable_roles ); ?></select>
 </td>
 </tr>