Make WordPress Core

Opened 3 years ago

Last modified 3 years ago

#53975 new defect (bug)

Send Reset Password bulk-action/link missing for non-super admins (multi-site only)

Reported by: jcutler's profile jcutler Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.8
Component: Users Keywords:
Focuses: administration, multisite Cc:

Description

Admin users in multi-site do not have the ability to send password reset emails from /wp-admin/users.php.

Repro Steps:
On a site with multisite, create a user, assign admin role.
Go to /wp-admin/users.php.

Expected Results:
Admin can send a reset password email to any user.

Actual Results:
Send password reset link missing from actions links
Send password reset option missing from bulk-actions drop-down

Other Information:
class-wp-users.php -> get_bulk_actions() uses "if ( current_user_can( 'edit_users' ) )" as the condition to determine if this can be allowed. The same check is performed in the single_row() method when the actions are specified.

I understand there are restrictions in multi-site for user creation/editing for non-super admins, however I believe this is not a security action and should not be restricted for site administrators.

Change History (1)

#1 @SergeyBiryukov
3 years ago

  • Component changed from Administration to Users
  • Focuses administration multisite added
Note: See TracTickets for help on using tickets.