ms-files.php: inconsistent behaviour for upload visibility on archived sites

[antwortzeit]

Hey,

i just ran into an odd issue on one of our clients Multisites. I archived the said site and – as you know – it remains accessible for network admins. The matching files however don't. I followed this down to ms-files.php::21ff.

<?php

if ( $current_blog->archived == '1' || $current_blog->spam == '1' || $current_blog->deleted == '1' ) {
        status_header( 404 );
        die( '404 &#8212; File not found.' );
}

You see that ms-files.php checks, if the blog is archived (or spam or deleted) and than throws out a 404. Shouldn't this include a check for network admin users to see the files? Or, if that's not desirable, couldn't we make this check accessible for filters?

Thanks for the good work!

Christian

[jeremyfelt]

Hi @antwortzeit, thanks for taking the time to open a ticket. We should be able to provide some more consistency here.

It looks like the safest way would be to add an is_super_admin() check rather than rely on any other capabilities. Because ms-files.php uses SHORTINIT, some of our other options are limited.

Trac Ticket: Core-36803

## Description:

• An issue was identified in the multisite installations where archived sites remain accessible to network administrators, but the associated files do not. This behavior originates from the logic in ms-files.php, particularly around line 21:

if ( $current_blog->archived == '1' || $current_blog->spam == '1' || $current_blog->deleted == '1' ) {
    status_header( 404 );
    die( '404 — File not found.' );
}

• The current implementation checks if the blog is archived, marked as spam, or deleted, and subsequently returns a 404 error for file requests. However, this does not account for network administrators who should retain access to these files.

## Proposed Solution

• An additional check using is_super_admin() has been implemented. This adjustment allows network administrators to access files even if the site is archived, spam, or deleted. The modified code snippet is as follows:

if ( ( $current_blog->archived == '1' || $current_blog->spam == '1' || $current_blog->deleted == '1' ) && ! is_super_admin() ) {
    status_header( 404 );
    die( '404 — File not found.' );
}

## Benefits

• Enhanced Access for Network Administrators: This change ensures that network admins can access necessary files for archived sites, improving usability and functionality.

• Preservation of Current Logic: The existing restrictions remain in place for regular users, maintaining intended access controls.