Is it safe to use the basic administration with reduced rights for private member space

Question

Is it safe to use the basic administration with reduced rights for private member space

J.BizMai

2020年10月23日 17:59

I know it´s not clearly a technical question, I did not find on the Web (maybe my location makes the job harder).

I have to develop a private member space.

It´s easier for me to use the wordpress backup (wp-admin folder) with reduced rights(capabilities) for subscribers (eg. access to his invoices ) but I´m little scary to make problems of security (like from subscriber, create a door to enter in administration and hack the website finding easier the admin login/password).

Most of plugins of membership use a custom private space only on front-end for members.

Is it safe to use the default wordpress back-end for members or make a private member space only on front-end is a better way to do that ( excluding the question of user interface customizing ) ?

Topic membership security Wordpress

Category Web

wrydere · Accepted Answer · 2020年10月23日 17:59

The short answer here is that the "subscriber" role is very much separate from authors, editors, and admins. It is intended to be a role for the public to use – mainly to leave comments without having to log in repeatedly, or to set their name when leaving comments.

So, from the perspective of "is a subscriber going to find it easier to hack their way to being an admin", the answer is no. WordPress core is built to prevent that.

Now, if you start modifying functionality / access to core features by checking for "subscriber" role or "read" capabilities, that could cause security issues, depending on how you craft it. So I would take care when building your logged-in system.

billybadass · Accepted Answer · 2020年10月23日 14:59

indeed from your question is not entirely clear what are you trying to achieve. However wordpress gives you the option to create custom roles and capabilities.

If you follow that native wordpress path, you should not be concerned about security.

check if the role exists
IFF not add the role and capibilities
Make sure to pass the capabilities to the admin as well

One function role_exists( $role ) {


if( ! empty( $role ) ) {
return $GLOBALS['wp_roles']->is_role( $role );
}

return false; }

Two if( !role_exists( 'customRole' ) ) {


 // $adm = $wp_roles->get_role('administrator');


add_role('Role', __('DisplayName'), 
   array(
       'read'            => true, // Allows a user to read
       'create_posts'      => false, // Allows user to create new posts
       'edit_posts'        => false, // Allows user to edit their own posts
       'edit_others_posts' => false, // Allows user to edit others posts too
       'publish_posts' => false, // Allows the user to publish posts
       'manage_categories' => false, // Allows user to manage post categories
       'create_pages' => true,  
       'edit_pages' => true,  
       'edit_others_pages' => true, // Allows user to edit others posts too
       'custom_capibility' => true,
     
       )
);

}

Three if (role_exists('customRole')){ $administrator = get_role('administrator'); $administrator->add_cap('custom_capibilities');

add_role

add cap

Is it safe to use the basic administration with reduced rights for private member space

About