Members not getting logged out – secured content still visible

  • Sandra

    (@sandracwalsh)


    8 years, 5 months ago

    Hello –

    At https://www.guelphwaldorf.ca/ I have a link (top right) to https://www.guelphwaldorf.ca/tws-parents/.

    This page requires a log-in, as the post on this page is in a category called Parent News with the following settings.

    Content Availability Content accessible to Everyone
    Content accessible to Logged Out Users
    checked: Content accessible to Logged In Users

    Roles who can see the content checked: Member checked: Admin

    However, it appears that the LOGOUT link https://www.guelphwaldorf.ca/logout/ is not actually logging members out, as the page is still accessible after logging out.

    Strangely, my WordFece Activity log is showing that the TWS Parent user is being logged out, but after the logout takes me back to the homepage, I can still see the content on the TWS Parents page.

    TWS Parent 2 in Canada Guelph, Canada left https://www.guelphwaldorf.ca/tws-parents/ and
    logged out successfully. https://www.guelphwaldorf.ca/logout/

    I also tried to “Apply custom access settings?” at the post level. This seemed to work for the first login after the change – the page was hidden and a login was requested – but then experienced the same issue when trying to get the logout to work.

    I have cleared the cache and disabled the WordFence firewall, but to no avail.

    Any help would be greatly appreciated.

Viewing 8 replies - 1 through 8 (of 8 total)
  • Thread Starter Sandra

    (@sandracwalsh)

    I have created a temporary user to test this:

    TempMember/T3mp@M3mb3r

    Thread Starter Sandra

    (@sandracwalsh)

    UPDATE: If I go to DASHBOARD > USERS and scroll down to

    >> Account Management
    > Sessions >> Log Out Everywhere

    And log out the Member users, then everything works properly again.

    Plugin Support Ultimate Member Support

    (@ultimatemembersupport)

    Hi @sandracwalsh,

    Do you have a caching plugin installed on your site? If you have, please try disabling the cache and see if this resolves the issue.

    Thanks.

    Thread Starter Sandra

    (@sandracwalsh)

    That worked. I turned off WP Super Cache > Caching Off and the logout was processed correctly.

    Please let me know if there are any settings I need to change to get this to work with WP Super Cache.

    If there is another caching plugin that Ultimate Member is compatible with, I would be happy to switch to that.

    Thank you,
    Sandra

    Thread Starter Sandra

    (@sandracwalsh)

    From the Ultimate Member plugin page: “The plugin works with popular caching plugins by automatically excluding Ultimate Member pages from being cached.”

    Can you please let me know which Ultimate Member pages/strings I should add to the exceptions so that the log out’s work correctly?

    “Add here strings (not a filename)
    that forces a page not to be cached.”

    Many thanks!

    Plugin Support Ultimate Member Support

    (@ultimatemembersupport)

    Hello,

    You may exclude all pages that you assigned in Admin > UM > Settings > Setup or those UM pages that has an issue with WP super cache as UM has its own built-in cache.

    Thanks.

    Thread Starter Sandra

    (@sandracwalsh)

    Thank you.

    I have added the following to the strings that should not be cached:

    /user/
    /account/
    /members/
    /register/
    /logout/

    But the log-out is still not working. Any other ideas?

    Happy to try a different cache plugin if you would suggest one that you know will work with UM.

    I’d like to get this questioned answered, as we’re having the same issue with our site. This is a fairly large security flaw. Our entire organizations’ member directory is visible to the public. I’ve followed similar steps as @sandracwalsh. She’s been very thorough and patient in her questions.

    Is there a caching plug-in you folks recommend?

    Thanks in advance.

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Members not getting logged out – secured content still visible’ is closed to new replies.