Page restrictions not working

Hi Mark,

This would happen if the code that is producing the page listing bypasses the WordPress API to obtain the posts (e.g. by pulling them directly from the database) or something (functions.php, another plugin, …) invalidates the filters that enforce the access restrictions.

How to you produce the list of pages?

Cheers

I don’t see any obvious plugins that might be contributing to the issue. Those installed include Jetpack, My Custom Functions, My Private Site, NextGEN Gallery, Rename Media Files, Simple Page Ordering, Social Login, Subscribe2, Updraft Plus, WordPress Force HTTPS and WordPress Media Library Folders.

I have the one test page. I simply assigned it to the IT Committee group, which exists but has no members.

My Custom Functions and My Private Site sound like they might have something to do with it but it’s a plain guess.

How do you create the list of pages?
Can you share a link to the page where this happens?

The site is private so unfortunately I cannot demo it for you. The procedure is straightforward:

– Create the group
– Create a page and assign it to the group
– Don’t assign any members to the group
– Logout and login as anyone else. Note that it shows in the list of pages and when I click on it I can see the test content.

… it shows in the list of pages …

– If it shows in this “list of pages” then it’s what I’ve mentioned earlier. Whatever creates the list, overrides the access restrictions.

when I click on it I can see the test content …

– That’s certainly a conflict then. You can try to find out what plugin is causing it by deactivating all except groups, and then enable other plugins individually until the access restriction stops working.

In a test environment disabling all plugins, activating Groups, then slowly reenabling each one, one at a time, worked. In a production environment the same approach did not. I tried things like clearing browser cache and flushing Supercache. So I’m kind of at a loss. Looks like I’ll have to look for some other solution.

Thanks for trying that out, which plugin was involved to make it stop working please?

For your production site, have you checked your theme’s functions.php or any customized code that might be involved?

If this happens with Groups, it might as well happen with other access restriction plugins, too. You seem to have something there which inadvertently compromises the access security of your content, who knows what else it messes with … I’d be cautious and make sure to know why that happens.

I can’t tell which one caused the issue. In my test environment, I disabled all plugins except Groups. Logged in as another user in a different browser I checked after each one was turned on if the restricted link appeared. It never did. In the production environment even with just the Groups plugin enabled it never went away when I accessed as a non-admin.

In the production environment even with just the Groups plugin enabled it never went away when I accessed as a non-admin.

If you’re sure that when you checked it you were fully logged out, then there’s something else involved obviously. Have you checked your theme’s functions.php or any customized code that might be involved? Is caching for logged in users enabled? If that’s the case, then the system might have built a cache entry for the authorized user and then presented that to plain visitors as well. As I’ve mentioned before, I would be cautious to find out why this happens on your site, it doesn’t matter if you’re using Groups or something else to restrict access, I’d just recommend for your site’s consistency to find out why it happens ??

I’m going to mark this as resolved as the issue is not within Groups itself, I hope that this still helps you and just let me know if you have further questions.