WordPress.org

Make WordPress Core

Opened 7 weeks ago

Last modified 6 weeks ago

#43936 new defect (bug)

Settings: Warn when open registration and new user default is privileged

Reported by: kraftbj Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Users Keywords: has-patch
Focuses: administration Cc:

Description

Much like our Strong Passwords work, we can help inform site administrators when their actions may be sub-optimal.

WordPress allows a site owner to open registration AND set the default new user level to "Administrator". While this combination may make sense for some sites (on an intranet?), this is typically a really really bad idea.

We should provide some type of confirmation to ensure site administrators are intending to open their site up.

If registration is open and default level is Subscriber (read cap only), the current behavior is fine. If registration is open and other capabilities are included in the default role, we should have some type of checkbox or "are you sure" notice. "By allowing open registration and a default role of {role}, anyone who can visit the site would have the ability to {have full control of your site|publish content|etc}."

We saw this in the wild on a site in support today :).

Attachments (3)

43936.diff (834 bytes) - added by subrataemfluence 7 weeks ago.
43936.2.diff (1.8 KB) - added by kraftbj 7 weeks ago.
43936.3.diff (2.1 KB) - added by kraftbj 7 weeks ago.

Download all attachments as: .zip

Change History (10)

#1 @subrataemfluence
7 weeks ago

  • Component changed from Administration to Users
  • Focuses administration added

Good catch!! Rather having a checkbox to "confirm", I would rather suggest to remove the "Administrator" option from the dropdown from this page. Since admin always has the ability to change a user's role he can easily do so by going to that user's profile any time.

I agree that opening Administrator privilege for a new user registration should not be an option anyway!

#2 @subrataemfluence
7 weeks ago

  • Keywords has-patch added

I have added an additional optional parameter which will allow to pass an array of roles which need to be excluded from the dropdown.

Example:

<?php
wp_dropdown_roles( get_option('default_role'), array( 'administrator', 'editor' ) );

Above code won't render Administrator and Editor roles in the dropdown.

However, if called like

<?php
wp_dropdown_roles( get_option('default_role') );

All roles will be available in the dropdown like now.

Last edited 7 weeks ago by subrataemfluence (previous) (diff)

This ticket was mentioned in Slack in #gdpr-compliance by desrosj. View the logs.


7 weeks ago

#4 @kraftbj
7 weeks ago

Thanks for the patch @subrataemfluence! A couple of logistical notes on the patch - It is helpful to run the svn diff from the root so you have the full path (e.g. src/wp-admin/includes/template.php instead of just template.php). That'll make it easier to apply to patch.

Also, be sure your code follow WordPress Coding Standards ( https://make.wordpress.org/core/handbook/best-practices/coding-standards/php/ ). There were a few spacing issues that I noticed.

Submitting a follow-up patch that includes updated inline docs, coding standards compliance, and implements the modified wp_dropdown_roles to resolve the ticket issue.

@kraftbj
7 weeks ago

#5 follow-up: @kraftbj
7 weeks ago

A couple of things:

  1. We should add a filter so plugins can add additional roles (e.g. Keymaster) to exclude or to allow more roles (e.g. a private intranet where one _does_ want to allow new users as Admins).
  1. Does it make sense to exclude roles or exclude certain capabilities?

@kraftbj
7 weeks ago

#6 in reply to: ↑ 5 @subrataemfluence
6 weeks ago

Thank you for further fine tuning my proposed patch and thumb up for the introduction of the additional filter!

By the way, I forgot to upload the patch for template.php! :P

Replying to kraftbj:

A couple of things:

  1. We should add a filter so plugins can add additional roles (e.g. Keymaster) to exclude or to allow more roles (e.g. a private intranet where one _does_ want to allow new users as Admins).
  1. Does it make sense to exclude roles or exclude certain capabilities?

#7 @subrataemfluence
6 weeks ago

I would rather suggest this ticket to be labeled as "Feature request" since the current functionality does not have any bug in it.

Note: See TracTickets for help on using tickets.