Make WordPress Core

Opened 13 months ago

Last modified 2 months ago

#64006 new defect (bug)

Usermeta not stored for super-admin

Reported by: sebastienserre Owned by:
Priority: normal Milestone: Awaiting Review
Component: Networks and Sites Version:
Severity: normal Keywords: 2nd-opinion
Cc: Focuses: multisite

Description

On a multisite context, a super-admin has access to all websites of the multisite but the user is not added as a user of the website.

As a result, in a block editor context, if we update a user_meta for a super admin, the route ​http://localhost:8888/sub-site/wp-json/wp/v2/users/me is returning a 404 error.

In Polylang Pro, we're updating a usermeta according to settings on a post edit page. This setting is not stored in the super-admin usermeta.

The workaround we have found is to manually add the super-admin as an existing user on the subsite to make the route available.

We think, a super-admin should be automatically added as Administrator on each website of the network.

Change History (2)

#1 @realloc
3 months ago

For context: a super admin not being a member of each subsite is intentional in multisite. Super admins get their capabilities through is_super_admin() / map_meta_cap rather than through a per-site role, so there is deliberately no wp_<id>_capabilities user meta entry on each site. Auto-adding every super admin as an Administrator on every site of the network would create a user meta row per site per super admin, which does not scale well on large networks (thousands of sites) and duplicates privileges that already resolve through the super admin check.

That said, the more interesting issue here may be the REST behavior rather than site membership: GET /wp/v2/users/me returning a 404 for a user who effectively has access. It would be helpful to reframe this ticket around whether the users controller should account for super admin privileges on the me route, instead of requiring the user to be a registered member of the subsite.

#2 @realloc
2 months ago

  • Keywords 2nd-opinion added
Note: See TracTickets for help on using tickets.