[Plugin: User Role Editor] Hole security

Firstly thank you for your reply.

Here is an example of how to test (test to be used with WordPress 3.0.1 Multisite):
– Create a blog child with several users reported as users of this blog with at least one superadmin and a simple admin of the blog (other types of users are not affected by default since they do not see users menu, but users can still serve to complete the tests).
– Then you have to log in as a blog child (simple) admin. When the extension is enabled, the admin can then connect to the place of any other user of the blog even superadmin and thus access to its own dashboard superadmin.
This is not disruptive to other types of users but should not be able to access SuperAdmin which holds all rights to all of all blogs.

I hope I was clear in my explanation …

Thanks for you help.

Hello Vladimir
Here with a little delay a step by step to make my explanation clearer:
In the same time look this page (http://www.deluxeblogtips.com/2010/05/multisite-wordpress-30.html) to have more details and screenshots.

1)Installation:
You must install the last WordPress (3.0.1) with mulitsite/network ability, and is available only if WP_ALLOW_MULTISITE is defined in wp-config.php. (for example this url: http://localhost/wp/)
For more information about news in WordPress 3.0 : http://codex.wordpress.org/Version_3.0
For more information about Multisite : http://codex.wordpress.org/Create_A_Network
After, you must show the Super Admin Menu : http://codex.wordpress.org/Super_Admin_Menu

2)Create a new site:
– Click on the Sites item on the Super Admin menu, a new page appears that allows you to see existing sites and create new site.
– To add a new site, enter its address (in this situation, we use sub-directories), title and admin email, then click on Add Site.
– Once new site is created, you can visit it via new address (for example: http://localhost/wp/test). It looks like a normal WordPress blog.

3)Manage the new site :
– Go back to Sites menu, when you move mouse over a site name, you can see some actions for the site: Edit, Backend, Deactivate, Archive, Spam, Delete and Visit…
– Click on the Backend link, you’ll go to the dashboard page of the new site. After logging in, you’ll see a normal Dashboard for the site, here you can add new posts, edit posts, change themes or do whatever you want.

4)Add users in the new site for test :
Go to the users menu (not in the Super Admin Menu but below the menu extensions) and create 3 users for test in this new site :
– first user (ex : toto1) as administrator of the new site
– second user (ex : toto2) as editor or contributor… (all role as you want but not as administrator)
– third user (ex : toto3) as administrator or editor or contributor… (all role as you want) but also with super admin privileges for the Network. To do this, edit user information (of toto3) and select grant the user super admin privileges for the Network.

Now you must have 4 users in your system (you can see all and their sites from the Users item in the Super Admin menu) :
– you (or first user created during installation) as super-admin in the network
– toto1 as administrator but only in the new site
– toto2 as user of the new site
– toto3 as user of the new site and super-admin in the network

5)Tests:
Install your plugin and try that :
– First log off
– Go to the new site (for example: http://localhost/wp/test)
– Sign in as toto1 administrator
– Go to the users menu (you must see the 3 users of this site toto1, toto2, toto3)
– Try your plugin with toto2 (there is no problem)
– Now try with toto3 : as toto3 is Super Admin you can see all menus including super-admin menu, so you can take full control over the site and the network…

I think it may be a serious problem.
To resolve this problem, you should find interesting the option to “grant the user admin privileges for the Super Network” which is new in WordPress 3.0

I hope this time I was clearer in my explanation …

Thanks for you help.

Vladimir,

I’m really sorry but since the beginning all my messages dealt another plugin: User Switching

However, if you have a little patience, I have a question about your plugin “User Role Editor”

Is it possible to change a global role for these changes are retained in every creation of new blog?
Example: I am a contributor to download files (pictures, etc.) and once the changes recorded all new contributors of all new blogs created have the same rights. Is this possible?

Again thank you sincerely for your help and your patience and sorry for my mistake

Thank you very much…