Timeline for Ajax Security regarding user priviliges and nonces
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 3, 2017 at 19:43 | vote | accept | kot | ||
| Dec 30, 2016 at 5:59 | comment | added | Milo | Not sure. The great and terrible thing about the documentation is that it can be edited by anyone. | |
| Dec 29, 2016 at 22:02 | comment | added | kot | Thanks again. Any idea then why the documentation explicitly states 'Carefully review the actions you are performing in your code since unprivileged users or visitors will be able to trigger requests with elevated permissions that they may not be authorized for.'? | |
| Dec 29, 2016 at 19:54 | comment | added | Milo |
is_admin is true when you are on an administration page, it has nothing to do with having an administrator role. it's about context of page, not capabilities of the user. use current_user_can to know if the user has permission to do something.
|
|
| Dec 29, 2016 at 19:22 | comment | added | kot | Thanks for the reply. Can you be more precise about is_admin() beeing true here? Why would it be true for every logged in user in another context? Can I still determine if a user is an admin in this context? | |
| Dec 28, 2016 at 1:46 | history | answered | Milo | CC BY-SA 3.0 |