Add Owner role

[tellyworth]

This patch adds a new 'owner' role. The owner is an administrator who cannot be demoted, deleted or edited by other administrators. Owner is a secondary role - the user is both an administrator and an owner.

In the current implementation there is only one owner at a time. The current owner can transfer ownership of the blog to another administrator on the Transfer Ownership tab (under Users). I implemented this as a plugin because some site owners won't want the feature there at all.

This is of most interest for MU, but it's also probably useful for some regular WordPress blogs with multiple users.

This would be particularly useful in conjunction with the user_role table from #5541, but it works fine with or without it.

[tellyworth]

Just a quick note in response to questions elsewhere.

This could be implemented by storing the owner's user_id in an option. My reasons for using a role instead are:

1. In conjunction with the user_role table in #5540, it becomes very easy to find the owner of a blog, or all blogs owned by a specific user in an MU install. Just a simple lookup or join on the user_role table "WHERE role='owner'".

2. Because it's a role it's easy to do a current_user_can() check.

[Denis-de-Bernardy]

Why not consider that the admin user who has the admin_email option as his email is the owner, and make that option changeable only by the owner?

[Denis-de-Bernardy]

see #10201

[jane]

I would love this, for the reasons outlined by @tellyworth in original ticket.

[nacin]

My thoughts after a discussion with Jane:

• Having an'Owner role would be beneficial for two reasons. 1, it would establish a link between a single admin account and the admin_email, thus improving that UI/UX. 2, by locking down ownership transfer, this is nice for security and site theft.

• The second part is primarily beneficial for multisites. It is also feasible only in multisite, unless you lock down plugin/theme installation (and probably upgrades) as well as the file editors to non-owners.

• An Owner role probably shouldn't be a role. It'd be much easier to bolt it onto the capabilities system similar to super admins.

• You could allow for an Owner to be specified in wp-config, which would then hide any UI for transferring ownership. Note that this wouldn't remove the requirement to disable file editors and installation, as you could easily inject a shell.

• I would think that Owner would be a nice feature to have for single-site -- it sounds like it should be an optional, opt-in way to link an account to the admin_email, and once that happens, the admin_email field would just go away for that site. For multisite, it could be enforceable at the network level for new sites. It sounds like it would get more use at the multisite level (the feature kind of sounds like the admin bar in that regard).

[johnjamesjacoby]

I think this makes a lot of sense, and sounds like it would mirror and then extend the way that the 'Key Master' role currently works in bbPress stand alone installations.

Is the idea that the current 'super admin' will act as a 'network owner' and the new 'owner' pseudo-role will act like a pinnable per-site owner? If that's not accurate, would we want to bake in having pinnable 'network owner' and 'global owner' role/caps, with global for multi-network installs, so there are ultimate uber users in complex installations in core?

[chriscct7]

This is an interesting idea, but the question might come up whether or not it should be a role. The idea of a user who cannot be deleted, or demoted could be useful for other users on the site. As such a capability would let it be used for that purpose.

[DrewAPicture]

I think this falls squarely in plugin territory though there does appear to be some core interest, even four years ago. However, with no significant activity in four years, marking as maybelater.

[dd32]

#30933 was marked as a duplicate.

[greenzilla]

I submitted ticket #30933. I think a user set within wp-config or an owner role would be an excellent improvement. I had an admin role compromised through a phishing attack and they removed all admin roles. I suggest core instead of a plugin since a compromised admin could deactivate/delete plugins.

[dshanske]

I think having the 'owner' has the benefit, as mentioned above, of establishing a relationship between the admin email and a user. It would allow the admin_email setting to be backward compatible, but still move forward to connecting the setting with a user, which is where it should be.

[melchoyce]

@tellyworth A full decade later, but do you have interest in this? Seems like a good idea.