[wp-trac] [WordPress Trac] #43936: Settings: Warn when open registration and new user default is privileged

[WordPress Trac]

#43936: Settings: Warn when open registration and new user default is privileged
-------------------------------------------------+-------------------------
 Reporter:  kraftbj                              |       Owner:  audrasjb
     Type:  feature request                      |      Status:  accepted
 Priority:  normal                               |   Milestone:  6.7
Component:  Security                             |     Version:
 Severity:  normal                               |  Resolution:
 Keywords:  has-patch needs-user-docs needs-     |     Focuses:
  testing changes-requested                      |  administration
-------------------------------------------------+-------------------------

Comment (by roytanck):

 I've been playing around with adding an additional check to
 `wp_insert_user`. If we can reliably determine in that function that the
 user being inserted is self-registering, we could simply return a
 `WP_Error` when the default role is privileged, similar to how other
 checks handle errors.


 {{{#!php
 if ( ! $update && $is_registering ) {
    $user_role = get_role( get_option( 'default_role' ) );
    if ( $user_role->has_cap( 'manage_options' ) ) {
        return new WP_Error( 'empty_data', __( 'Unable to create user.
 Unsafe default role detected.' ) );
    }
 }
 }}}

 Like with the other failed checks, this would show a generic message to
 the user who's registering ("Unable to register, please contact the site
 administrator."). Obviously, any mechanism to allow a privileged default
 role could be added to this, although I still fail to see any plausible
 use-case.

 I'd really like to add something like this in addition to the dropdown
 filter and the health check to harden against exploits where options are
 overwritten through other means than the UI.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/43936#comment:59>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform