Changeset 10903

Timestamp:

04/14/2021 05:08:34 AM (5 years ago)

Author:

dd32

Message:

Login: Allow members of the blog (not just super admins) to access wp-admin.

This allows certain moderators access to the pending user list.

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (2 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -345 +345 @@
                                                         $this->_redirect_to_source_or_profile();
                                                 }
-                                        } elseif ( ( is_admin() && is_super_admin() ) || 0 === strpos( $_SERVER['REQUEST_URI'], '/wp-json' ) || 0 === strpos( $_SERVER['REQUEST_URI'], '/xmlrpc.php' ) ) {
+                                        } elseif (
+                                                (
+                                                        ( is_admin() || wp_installing() ) &&
+                                                        ( is_super_admin() || is_user_member_of_blog() )
+                                                ) ||
+                                                0 === strpos( $_SERVER['REQUEST_URI'], '/wp-json' ) ||
+                                                0 === strpos( $_SERVER['REQUEST_URI'], '/xmlrpc.php' )
+                                        ) {
                                                 // Do nothing, allow access to wp-admin, wp-json and xmlrpc.php on login.wordpress.org
                                         } elseif ( is_user_logged_in() ) {
@@ -558 +565 @@
 
                 /**
-                 * The `send_auth_cookies` action used for the below function has no user context.
-                 * This function provides user context to it via the local static.
+                 * Hooked to 'set_auth_cookie' to provide action to the below function, as the
+                 * `send_auth_cookies` filter used for the below function has no user context.
                  */
                 public function maybe_block_auth_cookies_context_provider( $auth_cookie = null, $expire = null, $expiration = null, $user_id = null ) {