Automattic / Automattic/jetpack
JSON API: do not allow admins to manage site when the admin role has been edited
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 790
Description
Plugins like [Multisite Plugin Manager](https://wordpress.org/plugins/multisite-plugin-manager/) allow super admins to change the admin role on network sites, thus blocking them from activating or deactivating plugins.
Jetpack's JSON API module goes around this limitation, since these admins will be able to manage the site from WordPress.com.
It'd be nice if we could detect when the admin role has been edited, and stop allowing remote management in such cases.
Suggested here:
https://wordpress.org/support/topic/plugin-management-option-on-multisite?replies=3
cc @mrjarbenne
Contributor guide
Research direction
Start by tracing Jetpack's JSON API site-management permission checks and read the Multisite Plugin Manager behavior described in the issue and linked support thread. Confirm how edited administrator roles are represented in WordPress multisite; done means remote management is refused when that role has been changed, without blocking unaffected sites.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- api, authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100