admin管理员组文章数量:1318156
I know it´s not clearly a technical question, I did not find on the Web (maybe my location makes the job harder).
I have to develop a private member space.
It´s easier for me to use the wordpress backup (wp-admin folder) with reduced rights(capabilities) for subscribers (eg. access to his invoices ) but I´m little scary to make problems of security (like from subscriber, create a door to enter in administration and hack the website finding easier the admin login/password).
Most of plugins of membership use a custom private space only on front-end for members.
Is it safe to use the default wordpress back-end for members or make a private member space only on front-end is a better way to do that ( excluding the question of user interface customizing ) ?
I know it´s not clearly a technical question, I did not find on the Web (maybe my location makes the job harder).
I have to develop a private member space.
It´s easier for me to use the wordpress backup (wp-admin folder) with reduced rights(capabilities) for subscribers (eg. access to his invoices ) but I´m little scary to make problems of security (like from subscriber, create a door to enter in administration and hack the website finding easier the admin login/password).
Most of plugins of membership use a custom private space only on front-end for members.
Is it safe to use the default wordpress back-end for members or make a private member space only on front-end is a better way to do that ( excluding the question of user interface customizing ) ?
Share Improve this question edited Oct 23, 2020 at 17:15 J.BizMai asked Oct 23, 2020 at 14:19 J.BizMaiJ.BizMai 9002 gold badges10 silver badges30 bronze badges 2- Bear in mind that plugins can add capabilities for administrator that you might not even be aware of. also if you redice the rights of admins, how will real admins do those things you've removed? – vancoder Commented Oct 23, 2020 at 15:28
- @vancoder, Sorry I was not clear. Reduced rights for "subscriber" logged inadministration (member space by default), not for admin user. – J.BizMai Commented Oct 23, 2020 at 17:11
2 Answers
Reset to default 0indeed from your question is not entirely clear what are you trying to achieve. However wordpress gives you the option to create custom roles and capabilities.
If you follow that native wordpress path, you should not be concerned about security.
- check if the role exists
- IFF not add the role and capibilities
- Make sure to pass the capabilities to the admin as well
One
function role_exists( $role ) {
if( ! empty( $role ) ) { return $GLOBALS['wp_roles']->is_role( $role ); }
return false; }
Two
if( !role_exists( 'customRole' ) ) {
// $adm = $wp_roles->get_role('administrator');
add_role('Role', __('DisplayName'),
array(
'read' => true, // Allows a user to read
'create_posts' => false, // Allows user to create new posts
'edit_posts' => false, // Allows user to edit their own posts
'edit_others_posts' => false, // Allows user to edit others posts too
'publish_posts' => false, // Allows the user to publish posts
'manage_categories' => false, // Allows user to manage post categories
'create_pages' => true,
'edit_pages' => true,
'edit_others_pages' => true, // Allows user to edit others posts too
'custom_capibility' => true,
)
);
}
Three
if (role_exists('customRole')){
$administrator = get_role('administrator');
$administrator->add_cap('custom_capibilities');
}
add_role
add cap
The short answer here is that the "subscriber" role is very much separate from authors, editors, and admins. It is intended to be a role for the public to use – mainly to leave comments without having to log in repeatedly, or to set their name when leaving comments.
So, from the perspective of "is a subscriber going to find it easier to hack their way to being an admin", the answer is no. WordPress core is built to prevent that.
Now, if you start modifying functionality / access to core features by checking for "subscriber" role or "read" capabilities, that could cause security issues, depending on how you craft it. So I would take care when building your logged-in system.
本文标签: securityIs it safe to use the basic administration with reduced rights for private member space
版权声明:本文标题:security - Is it safe to use the basic administration with reduced rights for private member space 内容由网友自发贡献,该文观点仅代表作者本人, 转载请联系作者并注明出处:http://www.betaflare.com/web/1742040837a2417541.html, 本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容,一经查实,本站将立刻删除。
发表评论