Front-end management pages errors

  • Resolved joefridaywebmaster

    (@mshragesnetnet)


    7 years, 4 months ago

    I’m having an issue with being able to set a user edit events page. The plugin appears to not keep the setting. There is a page where (in settings->page->other pages->Front-end management pages) there is a drop-down for the selection of: a user edit events page, a user edit locations page and user manage bookings page. At one point, I was able to select a page which I called rmc-edit-events (which is mostly empty) and access and use the edit function. Now it is set back to (None). Somehow, this setting was lost. The rmc-edit-events page is still in my wordpress pages list, but that page now does not show up in the drop-down list. In fact, it is not clear what pages are showing up in the drop-down list.

    The net effect is that the plugin seems to be blocking my setting of the Front-end management pages to an existing page and it is resetting it to (None) without my changing it to (None).

    The page I need help with: [log in to see the link]

Viewing 15 replies - 1 through 15 (of 17 total)

  • Apologies for the issues you’re experiencing. Did this begin after updating?

    Thread Starter joefridaywebmaster

    (@mshragesnetnet)

    Thank you for replying. No – we haven’t updated to wordpress 4.9 yet.

    Plugin Support angelo_nwl

    (@angelo_nwl)

    just to confirm, can I know what do you mean by “rmc-edit-events” ? did you modify any code or using custom code?

    Thread Starter joefridaywebmaster

    (@mshragesnetnet)

    No modifications – rmc-edit-events (which is mostly empty) is the page I once successfully assigned to the edit events front-end management page.
    That page is mostly empty created just for the edit events purpose.
    It is still in wordpress pages, it is NOT showing up in the drop-down list for edit events.

    Plugin Support angelo_nwl

    (@angelo_nwl)

    it seems to be working fine on our test site; can I know what is your current EM version?

    Thread Starter joefridaywebmaster

    (@mshragesnetnet)

    Event registration and booking management for WordPress. Recurring events, locations, google maps, rss, ical, booking registration and more!
    Version 5.8.1.1 | By Marcus Sykes | View details

    It’s possible this is a conflict caused by your theme or another plugin. To check if it is, can you test with all other plugins deactivated and while running the default WordPress theme?

    Thread Starter joefridaywebmaster

    (@mshragesnetnet)

    OK I found the problem. As we want only our retired people to see our pages and not the general public, we set the Publish Visibility setting to private. The pages shown in the drop-downs for the Front-end management pages are only those marked as Public Visibility. This is definitely contrary to allowing us to edit our events but keep them private to the group. From my perspective, it is a security hole for private blogs and websites.

    Plugin Support angelo_nwl

    (@angelo_nwl)

    just to confirm, when you say “but keep them private to the group” are you using buddypress?

    Thread Starter joefridaywebmaster

    (@mshragesnetnet)

    We are not using buddypress. We mark almost all of our pages as private visibility.

    You’re correct that pages marked as Private don’t show as an option under Events > Settings > Pages > Other Pages.

    If you want to mix closed and open pages, restricting access using an additional user roles or membership plugin will probably be more robust.

    Thread Starter joefridaywebmaster

    (@mshragesnetnet)

    We have one or two pages for prospective newcomers and the rest marked private. Adding an additional role and going through all the members to set them to the new role, then checking all the side effects of by-passing the standard wordpress roles seems a lot to do to restrict content to the members. If the plugin doesn’t protect it’s pages from non-logged in users, we’ll need to remove it.

    Content can be hidden based whether a user is logged using the conditional placeholders {logged_in} and {not_logged_in}:

    https://wp-events-plugin.com/documentation/conditional-placeholders/

    Thread Starter joefridaywebmaster

    (@mshragesnetnet)

    Caimin,

    So to see the page in the drop-down list for Pages->Other Pages->Front-end Management Pages->Edit events page, the referenced page must exist (no content needed) and must be marked public. It seems to me that, this could expose this page to viewing/editing by any hacker that guessed the slug. Since this is generated by the plugin and is not taken from the referenced page, there is no place, that I can see, to put the conditional placeholders for {logged_in}.

    We are not keen on exposing our event data to public viewing or editing, just the logged in members with the proper role or roles. On a functional level, I think the drop-down list should include, at a minimum, pages that are marked private visibility.

    Since this is part the dashboard and is accessed by the wordpress administrator only, this doesn’t change what the wordpress administrator can view or update as the wordpress administrator (as default) can view and update private visibility pages.

    Jim

    The visability of pages is for making entire pages public or private.

    The plugin conditional tags I mentioned are for making specific sections of pages public or private.

    If you want to combine those two features, which seems to be what you want to do, you’d need to use some custom coding.

    Specifically, you’d need to create a custom version of this template:
    /events-manager/templates/forms/event-editor.php

    This tutorial explains how to create custom templates that are upgrade-safe:
    https://wp-events-plugin.com/documentation/using-template-files/

Viewing 15 replies - 1 through 15 (of 17 total)
  • The topic ‘Front-end management pages errors’ is closed to new replies.

Tags