Automattic / Automattic/jetpack

Secondary Users: Access to modules that require a user account

Open
#18,938 0 comments 0 reactions 0 assignees View on GitHub
[Plugin] Jetpack [Pri] Low [Status] Auto-allocated Admin Page Bug Connect Flow Triaged
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

#### Steps to reproduce the issue

1. Create a fully connected Jetpack site
2. Add a new admin user
3. Log in with your new admin user and go to `Jetpack->Settings`
4. Modules that require the **current user** to be connected, like "Downtime Monitoring" will be enabled.

#### What I expected

Modules that require the **current user** to be connected, like "Downtime Monitoring" should be disabled

#### What happened instead
"Downtime Monitoring" is enabled. The link to "Configure your notification settings" will not work.

**Screenshots**
After clicking the "Configure your notification settings" with a non-connected secondary user:
Screenshot 2021-02-25 at 3 22 04 PM

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue by creating a connected Jetpack site, adding an administrator, and checking Jetpack → Settings as that secondary user. Trace the access checks for account-dependent modules such as Downtime Monitoring; done means those modules are disabled for non-connected users and the notification-settings link is not exposed.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.