Opened 2 years ago
Closed 19 months ago
#19612 closed defect (bug) (duplicate)
Author templates display all users on a multisite network, even if the user is not a member of a specific blog
Reported by: |
|
Owned by: | |
---|---|---|---|
Priority: | normal | Milestone: | |
Component: | Multisite | Version: | 3.3 |
Severity: | minor | Keywords: | 2nd-opinion |
Cc: | xoodrew@… |
Description
When loading an author template, WordPress should check against current users. If the author isn't valid, load 404 template.
If it's a multisite, WordPress should check the passed author slug against current users of the blog -- not all registered users of the network.
To replicate the issue, do the following:
- Create a WordPress multisite environment.
- Create a test blog and at least two users (User A and User B).
- Add User A to your test blog.
- In your browser's URL bar, type http://yourtestblogurl.com/author/userb
- Observe how user User B's profile information appears on the author page, even though User B is not a user of that specific blog.
Again, the ideal solution when loading author templates for a multisite network would be to check to see if a user is a current member of a given blog (and not the entire network).
Change History (8)
comment:2
follow-up:
↓ 7
scribu
— 2 years ago
Note that if the user has no posts (which they shouldn't), the 404 template is loaded, as expected.
comment:3
follow-ups:
↓ 4
↓ 5
scribu
— 2 years ago
- Keywords 2nd-opinion added; needs-patch removed
Given that when you remove a user from a blog, you're asked what to do with their posts, I'm not sure we should try to fix this.
comment:4
in reply to:
↑ 3
;
follow-up:
↓ 6
DrewAPicture
— 2 years ago
- Cc xoodrew@… added
Replying to scribu:
Given that when you remove a user from a blog, you're asked what to do with their posts, I'm not sure we should try to fix this.
Just a couple of questions:
- Do posts from other sites also show on said author archives?
- If a user is a member of multiple sites and you reassign their posts, what is the current behavior? Do they get reassigned to a single user and a single site?
Assuming posts should remain exclusive to sites, shouldn't we focus on maintaining that exclusivity when posts are reassigned? That may be enough for a new ticket depending on the current behavior.
Regardless, if I have multiple sites in MU, I don't necessarily want users from one site showing on other sites' author archives.
comment:5
in reply to:
↑ 3
SergeyBiryukov
— 2 years ago
comment:6
in reply to:
↑ 4
scribu
— 2 years ago
Replying to DrewAPicture:
- Do posts from other sites also show on said author archives?
Never.
- If a user is a member of multiple sites and you reassign their posts, what is the current behavior? Do they get reassigned to a single user and a single site?
Posts can only have a single author. Posts never get moved between sites.
Regardless, if I have multiple sites in MU, I don't necessarily want users from one site showing on other sites' author archives.
The idea is that you'll get a 404 anyway, since under normal conditions, you won't have any posts assigned to users that have no role on the current site. I.e. we should focus on fixing #15855
comment:7
in reply to:
↑ 2
mfields
— 2 years ago
Replying to scribu:
Note that if the user has no posts (which they shouldn't), the 404 template is loaded, as expected.
On a fresh, local multisite installation I did the following:
- Created new site.
- Created a new user.
- I did not add the user to the site.
- Requested the author archive for the new user on the new site.
At this point, Twenty Eleven loads author.php but displays the following no post found message: Nothing Found: Apologies, but no results were found for the requested archive. Perhaps searching will help find a related post.
Basically, author.php gets loaded if the author exists on the network regardless of whether they are associated with the site. I believe that a better solution would be for core to serve the 404 template in such instances bypassing author.php altogether.
comment:8
SergeyBiryukov
— 19 months ago
- Component changed from General to Multisite
- Milestone Awaiting Review deleted
- Resolution set to duplicate
- Status changed from new to closed
#20601 has a patch.
Confirmed. get_user_by() used in WP_Query doesn't check if the author has a role on the current blog.