wp-admin redirects in multisite based on permissions

[jane]

If you are in multisite and you try to go to wp-admin for a site you don't have permissions for, it automatically redirects you the primary site where you do have rights. This is confusing. It would be better to display an error message indicating that the user does not have permissions on this site, to contact netwrok admin if they feel this is an error, etc.

Marking as enhancement, but as a user this feels like a bug.

[andy]

Normal dashboard screen, empty menus, no buttons. Pluggable content: "You have reached the dashboard of /$blog_name/ but you have no privileges on this blog. Please visit one of your own dashboards or ask an administrator to add you to this one." List user's dashboards below. Hooks and a function (is_unprivileged_admin()?) to allow for custom handling.

[ryan]

add_action( 'admin_page_access_denied', 'redirect_user_to_blog', 99 );

Comment that out in wp-admin/includes/ms.php and you will get the standard "You do not have sufficient permissions to access this page." message rather than a redirect.

[ryan]

Rough draft

[ryan]

Maybe also make it easy to log in as another user and come back to the dash.

[ryan]

The gist

[andy]

Avoid mixing parts of speech: "Visit" and "Dashboard" links. Instead, how about "Site" and "Dashboard"?

[ryan]

(In [17762]) Show access denied page and list a user's sites if they visit an admin they don't have permissions for rather than redirecting to the users' primary blog. fixes #17121

[jamescollins]

Look good Ryan, but is it meant to say:

access the "Test" dashboard

?

Shouldn't the word Test be replaced with the name of the site the user is currently trying to access?

[nacin]

(In [17763]) Use proper placeholders. No need to exit after wp_die(). fixes #17121.

[nacin]

Thanks jamescollins.

Wow, the increment code in redirect_user_to_blog() was janky. I'll miss it.

[ryan]

Bad cut-and-paste.

Aside: I use exit after wp_die on purpose even through it does nothing. A personal quirk in the name of explicitness. ;-)

[nacin]

Replying to ryan:

Bad cut-and-paste.

Aside: I use exit after wp_die on purpose even through it does nothing. A personal quirk in the name of explicitness. ;-)

I figured as much. It's much like using break in admin-ajax after a die(), or a break at the end of a switch. I do it too... But I have OCD and didn't like the parentheses.