Make WordPress Core

Opened 9 months ago

Last modified 3 months ago

#53224 new defect (bug)

Super admin cannot set an application password on a site they're not a member of

Reported by: johnbillion Owned by:
Milestone: 6.0 Priority: normal
Severity: normal Version: 5.6
Component: Application Passwords Keywords: has-patch has-unit-tests dev-feedback
Focuses: multisite Cc:


Steps to reproduce:

  1. Log into a Multisite installation as a Super Admin
  2. Visit the admin area of a site you're not a member of
  3. Visit your profile editing screen on that site (/wp-admin/profile.php)
  4. Try to add an application password
  5. Observe a mystery error message of "Invalid user ID"

This is due to this piece of logic which requires that the user is a member of the current site in order to set an application password.

To fix this, one of the following should be done:

  1. Skip this check for Super Admins and always allow them to add an application password
  2. Improve the error message and direct them to their network admin profile

Attachments (1)

53224.diff (769 bytes) - added by ilovecats7 7 months ago.

Download all attachments as: .zip

Change History (11)

#1 @TimothyBlynJacobs
9 months ago

  • Keywords good-first-bug added
  • Milestone changed from Awaiting Review to Future Release

Skipping the check for super admins makes sense to me!

7 months ago

#2 @ilovecats7
7 months ago

  • Keywords has-patch dev-feedback added; needs-patch removed

This ticket was mentioned in PR #1538 on WordPress/wordpress-develop by johnbillion.

6 months ago

  • Keywords has-unit-tests added

#4 @johnbillion
6 months ago

  • Keywords dev-feedback removed
  • Milestone changed from Future Release to 5.9

#5 @johnbillion
6 months ago

  • Keywords dev-feedback added; good-first-bug removed

The PR at adds a test for this and switches to using a capability check instead of a direct check for is_super_admin(). Just need somebody (eg. @georgestephanis) to confirm that the manage_sites cap makes sense.

#6 @prbot
6 months ago

georgestephanis commented on PR #1538:

Hrm. My MU-Fu is a bit on the weak side of late, I'm not sure if a global manage sites cap is best or -- is there maybe a manage_site( $site_id ) check, in case folks can manage one network but not another in the case of multi-network?

cc: @JJJ who I've always deferred to on this sort of thing for a hot take.

#7 @prbot
6 months ago

johnbillion commented on PR #1538:

Unfortunately there's no further granularity to manage_sites, see

This ticket was mentioned in Slack in #core by audrasjb. View the logs.

3 months ago

This ticket was mentioned in Slack in #core by audrasjb. View the logs.

3 months ago

#10 @audrasjb
3 months ago

  • Milestone changed from 5.9 to 6.0

As per today's bug scrub:
Since there's still some ongoing discussion in the PR, let's move this ticket to milestone 6.0.

Note: See TracTickets for help on using tickets.