MU & Subscribe 2: anyone can access locked site from "Your Subscriptions"

okay, setting the hidden blog to ‘mature’ does take the blog out of the listing on the Your Subscriptions menu

but … the security hole is still there.

i’ve had to change my hidden blog’s setting so the “mature” workaround was no longer viable.

sure enough, any user could see the Subscribe link and the View Settings link on the Your Subscriptions page

that won’t do.

all my users are registered on a very small site and only 6 of them should be able to even see the hidden blog in the listing of blogs at the bottom of this page.

i poked around into your-subscriptions.php, specifically line 239:

if ( is_user_member_of_blog($current_user->id, $blog['blog_id']) ) {
echo "<a href=\"". $blog['subscribe_page'] . "\">" . __('View Settings', 'subscribe2') . "</a>\r\n";
}
echo "<a href=\"" . esc_url( add_query_arg('s2mu_unsubscribe', $blog['blog_id']) ) . "\">" . __('Unsubscribe', 'subscribe2') . "</a></span>\r\n";
}

what my users see are all the blogs that have the Subscribe2 plugin enable, including the one that they are not a member of and normally can’t access directly because of a bit of code that checks their capabilities, then uses wp_redirect().

i moved your use of is_user_member_of_blog() to after foreach and finally, things work as expected: if a user is not a member of a blog, that blog does not show in the list of blogs they can subscribe to.

hope this code helps someone else 🙂

echo "<div class=\"s2_admin\" id=\"s2_mu_sites\">\r\n";
	if ( !empty($blogs_subscribed) ) {
		ksort($blogs_subscribed);
		echo "<h2>" . __('Subscribed Blogs', 'subscribe2') . "</h2>\r\n";
		echo "<ul class=\"s2_blogs\">\r\n";
		foreach ( $blogs_subscribed as $blog ) {
			if ( is_user_member_of_blog($current_user->id, $blog['blog_id']) ) {
				echo "<li><span class=\"name\"><a href=\"" . $blog['blogurl'] . "\" title=\"" . $blog['description'] . "\">" . $blog['blogname'] . "</a></span>\r\n";
				if ( $s2blog_id == $blog['blog_id'] ) {
				echo "<span class=\"buttons\">" . __('Viewing Settings Now', 'subscribe2') . "</span>\r\n";
			} else {
				echo "<span class=\"buttons\">";
				echo "<a href=\"". $blog['subscribe_page'] . "\">" . __('View Settings', 'subscribe2') . "</a>\r\n";
				echo "<a href=\"" . esc_url( add_query_arg('s2mu_unsubscribe', $blog['blog_id']) ) . "\">" . __('Unsubscribe', 'subscribe2') . "</a></span>\r\n";
				}
			}
			echo "<div class=\"additional_info\">" . $blog['description'] . "</div>\r\n";
			echo "</li>";
		}
		echo "</ul>\r\n";
	}

	if ( !empty($blogs_notsubscribed) ) {
		ksort($blogs_notsubscribed);
		echo "<h2>" . __('Subscribe to new blogs', 'subscribe2') . "</h2>\r\n";
		echo "<ul class=\"s2_blogs\">";
		foreach ( $blogs_notsubscribed as $blog ) {
			if ( is_user_member_of_blog($current_user->id, $blog['blog_id']) ) {
			echo "<li><span class=\"name\"><a href=\"" . $blog['blogurl'] . "\" title=\"" . $blog['description'] . "\">" . $blog['blogname'] . "</a></span>\r\n";
			if ( $s2blog_id == $blog['blog_id'] ) {
				echo "<span class=\"buttons\">" . __('Viewing Settings Now', 'subscribe2') . "</span>\r\n";
			} else {
				echo "<span class=\"buttons\">";
				echo "<a href=\"". $blog['subscribe_page'] . "\">" . __('View Settings', 'subscribe2') . "</a>\r\n";
				echo "<a href=\"" . esc_url( add_query_arg('s2mu_subscribe', $blog['blog_id']) ) . "\">" . __('Subscribe', 'subscribe2') . "</a></span>\r\n";
				}
			}
			echo "<div class=\"additional_info\">" . $blog['description'] . "</div>\r\n";
			echo "</li>";
		}
		echo "</ul>\r\n";
	}
	echo "</div>\r\n";
}