Critical Bug - FC Lost Your Password
I just opened a support ticket on this and notice at least 6 other fellow commuinty members expressing same bug concern in this space.
Critical Bug: When existing users request a new password at the FC portal login page, the link in their reset password email takes them to the default Wordpress functionality and gives the user login access to the website as an administrator. I have a wordpress multisite. Because of this bug, an evil individual could quickly access all private user info for each individual site and also delete/corrupt all the multisite files. This is a CRITICAL bug that requires prompt resolution - plzzzzzzz.
Existing FC portal users simply cannot be permitted to obtain wordpress administrator access when requesting password reset to the FC portal.
Oh my, I am so upset. I cannot launch until this matter is resolved and therefore I am prevented from generating revenue on each of the multisites.
Grinch go home and leave us Fluent Community Plugin lovers alone. Bah humbug.
Ouch!!!
Dear Lori Bennett , I am not sure I understand this clearly. The password reset functionality is handle by default WordPress passport resent form.
If a user has administrator role they will get admin access. FluentCommunity does not alter user roles or give other permissions to any users.
All the auth related things are handled by the default WP auth functions.
Thank you for your prompt attention. None of my team members have administrator level access as users. I even had the same problem when I was in incognito mode using a totally new fictitious user name and email address - the same thing happened. So, you are informing that the FC plugin code for password reset does not override or otherwise avoid the default wordpress password reset functionality. There must be a reason why existing users can login as administrators. This is a security issue and an FC member posted that he was having this same problem about 23 days ago. Since then several other members of the Fluent Community have posted experiencing the same problem. I welcome and appreciate any assistance in resolving this dilemna. Thank you again Shahjahan Jewel.
Lori Bennett Again, FluentCommunity does not alter user roles. The password reset is not handled by FluentCommunity. Would you please do these:
- Check your WordPress settings and see if you have selected the "Administrator" role for new account registration. That should be a subscriber.
- Please create a normal account and try to recreate the issue.
When you post like this without verifying, it just creates a misunderstanding amount other members.
Lori Bennett are you refering to a case where your fCommunity users get the Admin role in wp-admin area when they reset password or your fCommunity users have the Admin permission (not a role) in the fCommunity only once they reset the password (and it seems like users have the Admin role in fCommunity)?
In addition. What is your default role for your users in wp-admin (Subscriber?) and do you use any other then subscriber role (especially role with Edit access to fields aka Edit permissions) for your users in WP? Are you the only Admin in wp-admin and all WP users are Subscribers? Do you use any kind of automation/integration/plugin (PM Pro etc) for managing users role/permission other than native WP feature?
Mat Hi Mat - My users are all set to default "subscriber". No subscriber edit permissions either. I am the only admin. I do not use any automations/integration plugin for managhing user roles other than native WP feature.
The problem occurs when an existing registered user clicks "lost your password" on the FC portal login page. They are being redirected to login to the website user back-end wp-admin, when they should be redirected to login to the FC portal (/portal/?fcom_action=auth) with their new password.
Website back-end user admin: Now, when the user clicks the emailed link they go through the WP reset process. After they create a new password, WP directs them to the website back-end user wp-admin dashboard. Users not familiar with website development or WP wonder where they have landed as that dashboard doesn't instantly make sense as to their next step. Users then have to either click to visit the website or click to visit the Community Portal. If they click the portal it immediately takes them inside the portal without having to login with the reset password.
Other times, intermittently, after users create new password and click login, they login to wp-admin and since they are subscriber not administrator role a message pops on screen that they do not have permission to access. This leaves users wondering how to get back to the portal. So they have to go to the website and click register/login, which, on my website will take them to the FC login page.
An additional concern (although not critical) is that when a user clicks lost password, there is no indication as to their next step. They are not told to check their email for a password reset link. (There are lots of newbies who don't realize to check their email).
Hope this makes sense. I realize this is beta stage of this amazingly wonderful plugin, and there will be issues along the way. I panicked the other day when a user who reset password was able to login the adminstrator back-end of my multisite website and could have accessed private user info or deleted/corrupted files. That glitch has not happened since I submitted a support ticket.
Much appreciate all the member's insight and suggestions.
😍
Lori Bennett no worries at all. In this case your users don't have any admin permissions - they just can access the wp-admin backend which is normal/subscriber role in WP - I assume this is the case now where you don't wat your users access wp-admin/users area.
You should watch the below YT video and see how to prevent users going to the /wp-admin area once they are logged in. You just redirect them automatically to the portal link with for example FluentAuth plugin.
Note: it is a normal behavior for WP users to be able to go to the /wp-admin area and it doesn't mean that they have Admin access as long as they have the subscriber role assigned
https://youtube.com/watch?v=23NWCNFJ1ko?t=365
Ref: link
Mat Hi Mat - SOOOO helpful! David's tutorial is spot on. It also addressed future development areas of my multisite, including courses and payment gateways.
Thank you for taking the time to understand my dilemna and providing solutions. 🤗