Multisite – Capabilities reset when restricting access to a plugin

[ecuweb]

On a multisite setup, when we try to restrict access to a plugin following the instructions: https://www.role-editor.com/documentation/restrict-plugins-available-for-activation-deactivation/

It works but it also wipes the capabilities out for that user group and we have to reset those anytime we make an update to the plugin access piece.

This only seems to happen at the network level in the admin, if we go into a single site and make the change the capabilities are not modified.

Any ideas on what could be causing this? Thanks in advance!

[Vladimir]

Take into account that when you click “Update Network” at “Network Admin->Users->User Role Editor” URE overwrites user roles and add-ons settings data made for those roles for all subsites with user roles and add-ons settings data taken from the main site. Every site has the same roles and add-ons settings after this operations.

I suppose this explains why you lose the role(s) capabilities at the subsite level after the “Network Update” usage. This operation is for exact replication of main site roles data to all subsites.

[Channel Digital]

Also having this problem. @Vladimir – have sent the details via the contact form because I forgot to check the forum.

Replicate: Network Admin > Users > User Role Editor > duplicate Administrator role > click Plugins in right hand menu to open “Allow manage plugins”, click Update button in the modal (make selections or don’t, it doesn’t make a difference) > all capabilities are wiped for the role.

Note that you don’t have to click the main Update or Update Network button to see this bug, the Update button in the “Allow manage plugins” wipes the capabilites and saves the role (refreshing the page or switching between roles demonstrates that).

[Channel Digital]

This also happens when trying to use “Other Roles” as well.

There seems to be a conflict with the Redis Object Cache plugin (by Till Krüss) as well. We cannot add users while both the Redis and URE plugins are active, and attempting to change the capabilities across the network is painful (constantly flushing the object cache across all sites) or just doesn’t work.

This is also the case on a completely different multisite on a completely different server that doesn’t use the Redis plugin, it uses SiteGround’s own plugin and caching configuration.

[Andy Burns]

This is still an issue, and is occurring if I try and update any role at network admin > users > user role editor.

Wipes out all capabilities if I try to use meta box restriction OR other roles features. Replication can be found here: https://drive.google.com/file/d/1Ou5vNqp_1zyXIcFWAO0bgCh5DtgJpdZf/view?usp=sharing

Does not occur if I try to do on top level domain site where it has “apply to all sites” option. REGARDLESS of either lcoation on making those changes, none of the capabilities, eta box restrictions or other roles propagate down to the other sites, they have no effect.

URE Version 4.64.6.
WP 6.9.1

[Andy Burns]

Any update? I will try to debug by ruling out conflicting plugins.

[Vladimir]

The issue was reproduced. I investigate it and work on a fix.

[Vladimir]

Workaround: Do not use add-on related buttons ‘Meta Boxes’, ‘Other Roles’, ‘Post Edit’, ‘Plugins’ and ‘Import’ under ‘Network Admin->Users->User Role Editor’.

Under the main site of the multi-site network (top level domain site) these buttons work as expected, as under any other single site/subsite. The issue is related to the ‘Network Admin’ level only.

‘Update Network’ button works as expected, while you don’t wipe capabilities from user role(s) using add-on buttons from the list above.

Modules data update part should be refactored to get full compatibility with use under the Network admin. I will do it until April 9, 2026, to publish URE Pro updated version before WordPress 7.0 release.

[Andy Burns]

Thanks Vladimir. I’ve tested the workaround and can confirm that making URE changes at top level domain also fail. While they DO NOT wipe out capabilities there(thanks goodness), using ‘Meta Boxes’, ‘Admin Menu’, ‘Other Roles’ do not sync the changes to sub sites which is also problematic.

When you say “Update Network” button I do not see that at top level domain. I do see “Apply to All Sites” checkbox which I assume you mean the same thing?

WP clean demo setup WP 6.9.4 and URE Version 4.64.6

[Vladimir]

Thanks for the quick feedback. “Update Network” is the “Network Admin->Users->User Role Editor->Update Network” button. “Apply to All sites” checkbox visible at the main (top level domain) site of the network historically was appeared at the free version of URE and doesn’t replicate the add-ons (Meta Boxes, Admin menu, etc.) data for role for other sites. I suppose it would be better to hide “Apply to All sites” checkbox for the Pro version at all in order do not confuse users.

[Andy Burns]

Ah I misinterpreted the “workaround” that the propagation of those add on functions could be done at top level domain site too but that is just for capabilities. Yeah, hiding that in Pro (after this bug fix, since it does propagate capabilities) is a good idea.

[Andy Burns]

> Modules data update part should be refactored to get full compatibility with use under the Network admin. I will do it until April 9, 2026, to publish URE Pro updated version before WordPress 7.0 release.

Vladimir, just checking back that this is still planned?

[Vladimir]

Thanks for patience, Andy. Yes, I confirm the final date of this update.

[Author]

Posts