Home
Features
Members
F.A.Q.
Download
Guide
Blog
Forums

Woopra Forums » Troubleshooting

WP Plugin Bug

(5 posts)
  • Started 3 months ago by lordfish
  • Latest reply from textopus
  • This topic is not a support question

  • lordfish
    Member

    Hey, i have a own wordpress Blog. But if someone create a Account, he can access the Woopra Settings

    Screenshot: http://upload.wiiarefree.org/view/full/1083_ybj5a

    Posted 3 months ago #

  • Jardel
    Member

    yes! me too! i was coming to report this here
    and i have open registration
    this is a huge security flaw

    Posted 3 months ago #

  • Thomas
    Member

    See more here: http://www.woopra.com/forums/topic/woopra-wordpress-plugin-bug

    Posted 3 months ago #

  • lordfish
    Member

    there is no add_submenu(); in the woopra.php
    Why Woopra dont fix this bug?

    Posted 3 months ago #

  • Textopus
    Member

    The fix is actually quite easy.

    Replace this part in woopra.php (at the end):

    add_action('admin_menu', 'woopra_add_menu');
    add_action('template_redirect', 'woo_detect');
    add_action('wp_footer', 'woo_widget');

    if (get_option('woopra_track_admin') == 'YES') {
    add_action('admin_footer', 'woo_widget');
    }

    with this


    global $user_level;
    if( $user_level > 8 ) :
    add_action('admin_menu', 'woopra_add_menu');
    endif;
    add_action('template_redirect', 'woo_detect');
    if( $user_level < 10 ) :
    add_action('wp_footer', 'woo_widget');
    endif;
    if (get_option('woopra_track_admin') == 'YES') {
    add_action('admin_footer', 'woo_widget');
    }

    This will ignore your admin visits (if logged in) and will remove the admin panel for all users but the admin.

    Posted 3 months ago #

RSS feed for this topic

Reply

You must log in to post.