Unable to restrict access

  • Resolved hftobeason

    (@hftobeason)


    6 years, 5 months ago

    If I log in to my site as a “Registered User”, which should NOT allow access to any site pages EXCEPT the /user page, and I then open a new tab and manually type the URL of one of the supposedly restricted pages, the restricted page LOADS anyway. I believe I’ve set everything correctly – “Restrict access to this content?” is set for all restricted pages, with “Registered User” NOT checked. Any help most appreciated. TIA.

    ### Begin Install Info ###

    ## Please include this information when posting support requests ##

    — Site Info —

    Site URL: https://zealotslounge.com
    Home URL: https://zealotslounge.com
    Multisite: No

    — Hosting Provider —

    Host: DBH: mysql.zealotslounge.com, SRV: zealotslounge.com

    — User Browser —

    Platform: Apple
    Browser Name: Safari
    Browser Version: 11.1.2
    User Agent String: Mozilla/5.0 (Macintosh; Intel Ma
    c OS X 10_13_6) AppleWebKit/605.
    1.15 (KHTML, like Gecko) Version
    /11.1.2 Safari/605.1.15

    —- Current User Details —

    Role: administrator

    — WordPress Configurations —

    Version: 4.9.8
    Language: en_US
    Permalink Structure: /%year%/%monthnum%/%day%/%postname%/
    Active Theme: Kelly Child 1.0.0
    Page On Front: Welcome (#195)
    Page For Posts: EJ’s Notes (#174)
    ABSPATH: /home/zealotslounge/zealotslounge.com/
    All Posts/Pages: 384
    WP Remote Post: wp_remote_post() works
    WP_DEBUG: Disabled
    WP Table Prefix: Length: 9, Status: Acceptable
    Memory Limit: 40MB

    — UM Configurations —

    Version: 2.0.25
    Upgraded From: None
    Current URL Method:
    Cache User Profile: Yes
    Generate Slugs on Directories: Yes
    Rewrite Rules: Yes
    Force UTF-8 Encoding: No
    JS/CSS Compression: No
    Nav Menu Settings: Yes
    Port Forwarding in URL: No
    Exclude CSS/JS on Home: No

    — UM Pages Configuration —

    User: https://zealotslounge.com/user/
    Account: https://zealotslounge.com/account/
    Members: https://zealotslounge.com/account/
    Register: https://zealotslounge.com/register/
    Login: https://zealotslounge.com/
    Logout: https://zealotslounge.com/logout/
    Password Reset: https://zealotslounge.com/password-reset/

    — UM Users Configuration —

    Default New User Role: um_registered-user
    Profile Permalink Base: user_login
    User Display Name: full_name
    Force Name to Uppercase: No
    Redirect author to profile: No
    Enable Members Directory: No
    Use Gravatars: Yes
    Gravatar builtin image: mm
    UM Avatar as blank Gravatar: No
    Require a strong password: Off
    Editable primary email field in profile view: Off

    — UM Access Configuration —

    Panic Key:
    Global Site Access: Site accessible to Logged In Users
    Custom Redirect URL: zealotslounge.com
    Exclude the following URLs:
    Backend Login Screen for Guests: No
    Redirect to alternative login page:
    Backend Register Screen for Guests: No
    Redirect to alternative register page:
    Access Control widget for Admins only: No
    Enable the Reset Password Limit: Yes
    Reset Password Limit: 3Disable Reset Password Limit for Admins: No
    Blacklist Words: 5

    — UM Email Configurations —

    Mail appears from: The Zealots Lounge
    Mail appears from address: [email protected]
    Use HTML for E-mails: Yes
    Account Welcome Email: Yes
    Account Activation Email: No
    Pending Review Email: No
    Account Approved Email: Yes
    Account Rejected Email: No
    Account Deactivated Email: No
    Account Deleted Email: Yes
    Password Reset Email: Yes
    Password Changed Email: Yes

    — UM Total Users —

    All Users(1240)
    administrator(2)
    um_lifetime-member(49)
    um_registered-user(1169)
    um_short-term(20)
    none(0)

    — UM Roles —

    Administrator (administrator)
    Editor (editor)
    Author (author)
    Contributor (contributor)
    Subscriber (subscriber)
    Customer (customer)
    Shop manager (shop_manager)
    Lifetime Member (um_lifetime-member)
    Registered User (um_registered-user)
    Short Term (um_short-term)

    — UM Custom Templates —

    N/A

    — UM Email HTML Templates —

    N/A

    — Web Server Configurations —

    PHP Version: 7.0.30
    MySQL Version: 5.6.34
    Web Server Info: Apache

    — PHP Configurations —

    PHP Memory Limit: 256M
    PHP Upload Max Size: 100M
    PHP Post Max Size: 105M
    PHP Upload Max Filesize: 100M
    PHP Time Limit: 500
    PHP Max Input Vars: 3000
    PHP Arg Separator: &
    PHP Allow URL File Open: Yes

    — Web Server Extensions/Modules —

    DISPLAY ERRORS: N/A
    FSOCKOPEN: Your server supports fsockopen.
    cURL: Your server supports cURL.
    SOAP Client: Your server has the SOAP Client enabled.
    SUHOSIN: Your server does not have SUHOSIN installed.
    GD Library: PHP GD library is installed on your web server.
    Mail: PHP mail function exist on your web server.
    Exif: PHP Exif library is installed on your web server.

    — Session Configurations —

    Session: Disabled
    Session Name: PHPSESSID
    Cookie Path: /
    Save Path: /tmp
    Use Cookies: On
    Use Only Cookies: On

    — WordPress Active Plugins —

    Asgaros Forum: 1.10.0
    Better Search Replace: 1.3.2
    DreamObjects Backups: 4.2.0
    Gutenberg: 3.8.0
    Invisible reCaptcha: 1.2.1
    Jetpack by WordPress.com: 6.5
    Joomla2WP Migrated Users Authentication Plugin: 1.0.1
    MailChimp for WordPress: 4.2.5
    MailChimp User Sync: 1.7.5
    S3Bubble Amazon Web Services Media Streaming: 5.1
    S3Media Link Safe Lite Plugin: 2.0
    Ultimate Member: 2.0.25
    Ultimate Member – Google reCAPTCHA: 2.0.2
    WooCommerce: 3.4.5
    WooCommerce Gutenberg Products Block: 1.1.2
    WP-Optimize: 2.2.4
    WPForms Lite: 1.4.8.1

    ### End Install Info ###

    The page I need help with: [log in to see the link]

Viewing 15 replies - 1 through 15 (of 18 total)

  • I am facing the same issue. It’s not restricting access to specific pages I have set to be only accessible to logged in Users. What may be the cause?

    Thread Starter hftobeason

    (@hftobeason)

    Any help regarding this issue would be very much appreciated.

    Any “um-registered-user” role who has logged into my site as such is able to see ALL pages on the site (if they know the appropriate URLs) DESPITE being explicitly denied access in the UM Content Restriction area for each page. NOTE that the Ultimate Member Menu Settings for menus DOES work as expected – a “um-registered-user” role does NOT see those menu items that have been restricted for that role.

    We’re in deep trouble here… I expect it’s an error on our part, but we have no idea how to fix it.

    Thank you.

    Same trouble here, page restrictions seems to just not work! How come such a major bug was overlooked?
    I’m allowing access to a page to only a few specific roles, with a redirection for all the rest, but when I’m logging in as a user with a different role, I can still see the page, without being redirected.

    Plugin Support Ultimate Member Support

    (@ultimatemembersupport)

    Hi @hftobeason, @sbassah and @rusliko

    This issue can be caused by the access restriction priority.
    Is it possible to attach the screenshots of your access settings in Ultimate member -> Settings -> Access and screenshot of the UM content restriction widget on one of your restricted pages.
    Please also see this doc regarding access restriction priority.

    Let me know.
    Regards.

    Thread Starter hftobeason

    (@hftobeason)

    Thank you for your reply!

    I carefully consulted the access restriction priority page yesterday, and *think* I understand it – and believe that’s not my problem… but I can’t be sure.

    As for “attaching” screenshots – I don’t see a mechanism for doing so on this forum. Please advise.

    Thank you again!!!

    Hi, here’s my UM settings->access settings: https://prnt.sc/kw26rz
    And here’s the settings on the user page, which I’m trying to hide from some roles but show to others: https://prnt.sc/kw27eg
    With these settings, everyone seems to be able to access the page, restrictions don’t work.

    Thread Starter hftobeason

    (@hftobeason)

    Okay, so I created a new WP site from a fresh install, installed UM, and imported my users. I set up a number of pages. UM is *still* not restricting access.

    The relevant screen shots are here:

    https://app.box.com/s/60nwrs017kqae0l1vko8kqs4swnzx3vo

    Please advise. Thank you.

    Update: I realized that the problem is specific to pages defined as UM pages in UM settings (including User page).
    When I created a new page (“temp”) with the same shortcode as the User page, it was correctly blocked from the roles it was defined to restrict.
    However, as soon as I have defined temp as the User page, the restriction stopped working and allowed any role to see page.
    Now at least we know it’s definitely a bug of UM, not user settings.

    Thread Starter hftobeason

    (@hftobeason)

    When NOT logged in: Restrictions seem to work, i.e. no access to any BUT the login page, as intended.

    When any user IS logged in: Restrictions DO NOT work, i.e. ANY User Role has access to any page, despite restrictions in place.

    NOTE: The Menu item restrictions ARE working as intended, it’s just the PAGE item restrictions that are not working.

    • This reply was modified 6 years, 5 months ago by hftobeason.
    • This reply was modified 6 years, 5 months ago by hftobeason.
    Thread Starter hftobeason

    (@hftobeason)

    I created a NEW site, installed WP, installed UM.

    I added a Subscriber User.

    I restricted access to the Sample Page to Editors only.

    That WORKED.

    I added a new page. I restricted access to that new page to Editors only.

    That DID NOT WORK.

    Please advise. Thank you.

    Thread Starter hftobeason

    (@hftobeason)

    Further testing seems to indicate that this issue is related to the page designated as the “Posts” page.k. It seems that it is ONLY the “Posts” page that is ignoring any restrictions in my fresh clean install of WP and UM.

    Is that possible? Sensible?

    Please advise. Thank you.

    magic2today

    (@magic2today)

    Any solutions ever found for this? I have the exact same issue; I am unable to restrict access to the “posts page”. I can restrict the separate posts just fine, but as soon as any user who is not registered or logged in, go to the \posts URL, the full page with all posts shows without any restrictions.

    I have the same issue, the restrict access seems to be all messed up… did anyone come up with a solution?

    Moreover, I found another access issue with the Profile Tab. The problem is when I restrict the comments tab to “Only the owner” under UM-Appearance-Profile Menu. This tab doesn’t show to other user, which is fine.

    But actually, anyone (even not logged in) is able to access a user’s private tab (comments tab in my example) by entering the specific url address… Is this a bug or is it meant to be like this?

    https://www.domain.com/user/37/?profiletab=comments

    Same here!

    I selected only “Login users” have access to the page in “UM Content Restriction” but even when I have not logged in, I can still see the content. That is definitely not right. It is meaningless to create such membership system then. This is real urgent and important issue to be solved as quick as as possible. Pleaseeeeeeee.

    Thread Starter hftobeason

    (@hftobeason)

    I gave up on this and simply reconfigured my site so that the Posts page exists for all users, but shows specific Posts based on membership level.

Viewing 15 replies - 1 through 15 (of 18 total)
  • The topic ‘Unable to restrict access’ is closed to new replies.