WordPress.org
Get WordPress

Plugin Directory

Changeset 3487377


Ignore:
Timestamp:
03/20/2026 05:48:07 PM (9 days ago)
Author:
devpriyanshu
Message:

Release 1.0.1: fix user-edit/users access mapping and protect superadmin account editing

Location:
dp-admin-access-menu
Files:
4 edited
9 copied

Legend:

Unmodified
Added
Removed

  • dp-admin-access-menu/tags/1.0.1/dp-admin-access-menu.php

    r3440518 r3487377  
    44 * Plugin URI: https://wordpress.org/plugins/dp-admin-access-menu
    55 * Description: Control which WordPress backend menu items are visible to specific users. Perfect for managing user access and customizing admin experience.
    6  * Version: 1.0.0
     6 * Version: 1.0.1
    77 * Author: devpriyanshu
    88 * Author URI: https://profiles.wordpress.org/devpriyanshu/
    … …  
    2121
    2222// Define plugin constants
    23 define('DPAMA_VERSION', '1.0.0');
     23define('DPAMA_VERSION', '1.0.1');
    2424define('DPAMA_PLUGIN_DIR', plugin_dir_path(__FILE__));
    2525define('DPAMA_PLUGIN_URL', plugin_dir_url(__FILE__));

  • dp-admin-access-menu/tags/1.0.1/includes/class-dpama-menu-filter.php

    r3440518 r3487377  
    198198        }
    199199       
     200        // Protect superadmin profile from being edited by non-superadmin users.
     201        if ($this->is_editing_superadmin_user($current_page, $superadmin_id)) {
     202            wp_die(
     203                esc_html__('You do not have permission to access this page.', 'dp-admin-access-menu'),
     204                esc_html__('Access Denied', 'dp-admin-access-menu'),
     205                array('response' => 403)
     206            );
     207        }
     208       
    200209        // Check if current page is in allowed menus
    201210        // Also check variations (e.g., edit.php vs edit.php?post_type=page)
    202211        $page_allowed = false;
    203        
    204         // Direct match
    205         if (in_array($current_page, $allowed_menus)) {
    206             $page_allowed = true;
    207         } else {
     212        $current_page_candidates = $this->get_page_access_candidates($current_page);
     213       
     214       
     215        foreach ($current_page_candidates as $candidate_page) {
     216            // Direct match
     217            if (in_array($candidate_page, $allowed_menus, true)) {
     218                $page_allowed = true;
     219                break;
     220            }
     221           
    208222            // Check for partial matches (for query string variations)
    209223            foreach ($allowed_menus as $allowed_menu) {
    210224                // If current page starts with allowed menu or vice versa
    211                 if (strpos($current_page, $allowed_menu) === 0 || strpos($allowed_menu, $current_page) === 0) {
     225                if (strpos($candidate_page, $allowed_menu) === 0 || strpos($allowed_menu, $candidate_page) === 0) {
    212226                    $page_allowed = true;
    213227                    break;
    214228                }
    215229                // Handle edit.php variations
    216                 if (($current_page === 'edit.php' && $allowed_menu === 'edit.php') ||
    217                     (strpos($current_page, 'edit.php') === 0 && strpos($allowed_menu, 'edit.php') === 0)) {
     230                if (($candidate_page === 'edit.php' && $allowed_menu === 'edit.php') ||
     231                    (strpos($candidate_page, 'edit.php') === 0 && strpos($allowed_menu, 'edit.php') === 0)) {
    218232                    $page_allowed = true;
    219233                    break;
    220234                }
     235            }
     236           
     237            if ($page_allowed) {
     238                break;
    221239            }
    222240        }
    … …  
    336354        return '';
    337355    }
     356   
     357    /**
     358     * Return equivalent admin page slugs that should share access rules.
     359     *
     360     * @param string $current_page Current resolved admin page slug.
     361     * @return array
     362     */
     363    private function get_page_access_candidates($current_page) {
     364        $candidates = array($current_page);
     365       
     366        // User Management aliases:
     367        // user-edit.php and user-new.php are children of Users menu (users.php).
     368        if ($current_page === 'user-edit.php' || $current_page === 'user-new.php') {
     369            $candidates[] = 'users.php';
     370        } elseif ($current_page === 'users.php') {
     371            $candidates[] = 'user-edit.php';
     372            $candidates[] = 'user-new.php';
     373        }
     374       
     375        return array_values(array_unique($candidates));
     376    }
     377   
     378    /**
     379     * Check whether current request tries to edit superadmin user profile.
     380     *
     381     * @param string $current_page Current resolved admin page slug.
     382     * @param int    $superadmin_id Superadmin user ID.
     383     * @return bool
     384     */
     385    private function is_editing_superadmin_user($current_page, $superadmin_id) {
     386        if ($current_page !== 'user-edit.php' || empty($superadmin_id)) {
     387            return false;
     388        }
     389       
     390        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only access check.
     391        $target_user_id = isset($_GET['user_id']) ? absint($_GET['user_id']) : 0;
     392       
     393        return $target_user_id > 0 && $target_user_id === (int) $superadmin_id;
     394    }
    338395}
    339396

  • dp-admin-access-menu/tags/1.0.1/readme.txt

    r3440518 r3487377  
    44Requires at least: 5.0
    55Tested up to: 6.9
    6 Stable tag: 1.0.0
     6Stable tag: 1.0.1
    77Requires PHP: 7.0
    88License: GPLv2 or later
    … …  
    146146== Changelog ==
    147147
     148= 1.0.1 =
     149* Fixed user management access mapping so Users menu access correctly allows `user-edit.php` and `user-new.php`.
     150* Added protection to block non-superadmin users from editing the superadmin account.
     151
    148152= 1.0.0 =
    149153* Initial release
    … …  
    156160== Upgrade Notice ==
    157161
     162= 1.0.1 =
     163Fixes user edit access behavior for allowed Users menu and adds stricter superadmin account protection.
     164
    158165= 1.0.0 =
    159166Initial release of DP Admin Access Menu. Install to start controlling which menu items are visible to specific users.

  • dp-admin-access-menu/trunk/dp-admin-access-menu.php

    r3440518 r3487377  
    44 * Plugin URI: https://wordpress.org/plugins/dp-admin-access-menu
    55 * Description: Control which WordPress backend menu items are visible to specific users. Perfect for managing user access and customizing admin experience.
    6  * Version: 1.0.0
     6 * Version: 1.0.1
    77 * Author: devpriyanshu
    88 * Author URI: https://profiles.wordpress.org/devpriyanshu/
    … …  
    2121
    2222// Define plugin constants
    23 define('DPAMA_VERSION', '1.0.0');
     23define('DPAMA_VERSION', '1.0.1');
    2424define('DPAMA_PLUGIN_DIR', plugin_dir_path(__FILE__));
    2525define('DPAMA_PLUGIN_URL', plugin_dir_url(__FILE__));

  • dp-admin-access-menu/trunk/includes/class-dpama-menu-filter.php

    r3440518 r3487377  
    198198        }
    199199       
     200        // Protect superadmin profile from being edited by non-superadmin users.
     201        if ($this->is_editing_superadmin_user($current_page, $superadmin_id)) {
     202            wp_die(
     203                esc_html__('You do not have permission to access this page.', 'dp-admin-access-menu'),
     204                esc_html__('Access Denied', 'dp-admin-access-menu'),
     205                array('response' => 403)
     206            );
     207        }
     208       
    200209        // Check if current page is in allowed menus
    201210        // Also check variations (e.g., edit.php vs edit.php?post_type=page)
    202211        $page_allowed = false;
    203        
    204         // Direct match
    205         if (in_array($current_page, $allowed_menus)) {
    206             $page_allowed = true;
    207         } else {
     212        $current_page_candidates = $this->get_page_access_candidates($current_page);
     213       
     214       
     215        foreach ($current_page_candidates as $candidate_page) {
     216            // Direct match
     217            if (in_array($candidate_page, $allowed_menus, true)) {
     218                $page_allowed = true;
     219                break;
     220            }
     221           
    208222            // Check for partial matches (for query string variations)
    209223            foreach ($allowed_menus as $allowed_menu) {
    210224                // If current page starts with allowed menu or vice versa
    211                 if (strpos($current_page, $allowed_menu) === 0 || strpos($allowed_menu, $current_page) === 0) {
     225                if (strpos($candidate_page, $allowed_menu) === 0 || strpos($allowed_menu, $candidate_page) === 0) {
    212226                    $page_allowed = true;
    213227                    break;
    214228                }
    215229                // Handle edit.php variations
    216                 if (($current_page === 'edit.php' && $allowed_menu === 'edit.php') ||
    217                     (strpos($current_page, 'edit.php') === 0 && strpos($allowed_menu, 'edit.php') === 0)) {
     230                if (($candidate_page === 'edit.php' && $allowed_menu === 'edit.php') ||
     231                    (strpos($candidate_page, 'edit.php') === 0 && strpos($allowed_menu, 'edit.php') === 0)) {
    218232                    $page_allowed = true;
    219233                    break;
    220234                }
     235            }
     236           
     237            if ($page_allowed) {
     238                break;
    221239            }
    222240        }
    … …  
    336354        return '';
    337355    }
     356   
     357    /**
     358     * Return equivalent admin page slugs that should share access rules.
     359     *
     360     * @param string $current_page Current resolved admin page slug.
     361     * @return array
     362     */
     363    private function get_page_access_candidates($current_page) {
     364        $candidates = array($current_page);
     365       
     366        // User Management aliases:
     367        // user-edit.php and user-new.php are children of Users menu (users.php).
     368        if ($current_page === 'user-edit.php' || $current_page === 'user-new.php') {
     369            $candidates[] = 'users.php';
     370        } elseif ($current_page === 'users.php') {
     371            $candidates[] = 'user-edit.php';
     372            $candidates[] = 'user-new.php';
     373        }
     374       
     375        return array_values(array_unique($candidates));
     376    }
     377   
     378    /**
     379     * Check whether current request tries to edit superadmin user profile.
     380     *
     381     * @param string $current_page Current resolved admin page slug.
     382     * @param int    $superadmin_id Superadmin user ID.
     383     * @return bool
     384     */
     385    private function is_editing_superadmin_user($current_page, $superadmin_id) {
     386        if ($current_page !== 'user-edit.php' || empty($superadmin_id)) {
     387            return false;
     388        }
     389       
     390        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only access check.
     391        $target_user_id = isset($_GET['user_id']) ? absint($_GET['user_id']) : 0;
     392       
     393        return $target_user_id > 0 && $target_user_id === (int) $superadmin_id;
     394    }
    338395}
    339396

  • dp-admin-access-menu/trunk/readme.txt

    r3440518 r3487377  
    44Requires at least: 5.0
    55Tested up to: 6.9
    6 Stable tag: 1.0.0
     6Stable tag: 1.0.1
    77Requires PHP: 7.0
    88License: GPLv2 or later
    … …  
    146146== Changelog ==
    147147
     148= 1.0.1 =
     149* Fixed user management access mapping so Users menu access correctly allows `user-edit.php` and `user-new.php`.
     150* Added protection to block non-superadmin users from editing the superadmin account.
     151
    148152= 1.0.0 =
    149153* Initial release
    … …  
    156160== Upgrade Notice ==
    157161
     162= 1.0.1 =
     163Fixes user edit access behavior for allowed Users menu and adds stricter superadmin account protection.
     164
    158165= 1.0.0 =
    159166Initial release of DP Admin Access Menu. Install to start controlling which menu items are visible to specific users.
Note: See TracChangeset for help on using the changeset viewer.