Make WordPress Core

Opened 5 years ago

Last modified 5 years ago

#53975 new defect (bug)

Send Reset Password bulk-action/link missing for non-super admins (multi-site only)

Reported by: jcutler Owned by:
Priority: normal Milestone: Awaiting Review
Component: Users Version: 5.8
Severity: normal Keywords:
Cc: Focuses: administration, multisite

Description

Admin users in multi-site do not have the ability to send password reset emails from /wp-admin/users.php.

Repro Steps:
On a site with multisite, create a user, assign admin role.
Go to /wp-admin/users.php.

Expected Results:
Admin can send a reset password email to any user.

Actual Results:
Send password reset link missing from actions links
Send password reset option missing from bulk-actions drop-down

Other Information:
class-wp-users.php -> get_bulk_actions() uses "if ( current_user_can( 'edit_users' ) )" as the condition to determine if this can be allowed. The same check is performed in the single_row() method when the actions are specified.

I understand there are restrictions in multi-site for user creation/editing for non-super admins, however I believe this is not a security action and should not be restricted for site administrators.

Change History (1)

#1 @SergeyBiryukov
5 years ago

  • Component Administration → Users
  • Focuses administration multisite added
Note: See TracTickets for help on using tickets.