Automattic / Automattic/jetpack

JSON API: do not allow admins to manage site when the admin role has been edited

Open
#1,427 5 comments 0 reactions 0 assignees View on GitHub
[Feature] Manage [Feature] WPCOM API Enhancement
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 14h
Merged PRs (30d)
790

Description

Plugins like [Multisite Plugin Manager](https://wordpress.org/plugins/multisite-plugin-manager/) allow super admins to change the admin role on network sites, thus blocking them from activating or deactivating plugins.

Jetpack's JSON API module goes around this limitation, since these admins will be able to manage the site from WordPress.com.

It'd be nice if we could detect when the admin role has been edited, and stop allowing remote management in such cases.

Suggested here:
https://wordpress.org/support/topic/plugin-management-option-on-multisite?replies=3

cc @mrjarbenne

Contributor guide

Open the contributing guide

Research direction

Start by tracing Jetpack's JSON API site-management permission checks and read the Multisite Plugin Manager behavior described in the issue and linked support thread. Confirm how edited administrator roles are represented in WordPress multisite; done means remote management is refused when that role has been changed, without blocking unaffected sites.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
api, authorization, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.