I am setting up a WordPress with a user system. User information (names, profile picture) of all users should be private, and only accessable when logged in.
The "Ultimate Member" plugin provides a shortcode, which then displays information about a user:
[ultimatemember form_id="731"]
To hide this information from non logged in users, they propose to wrap it as follows:
[um_loggedin][ultimatemember form_id="731"][/um_loggedin]
Now the user information is only visible when logged in.
But, am I mistaken, or would any direct request to the user data (e.g. what is under the hood of the first shortcode) base still return private information?
For example, when you have the URL, the profile picture could still be accessed at
https://www.example.com/wp-content/uploads/ultimatemember/3/profile_photo-190x190.jpg
From what I understand, the only type of real security here is security through obscurity, which is no security at all. I must be mistaken; how does this work?
I have since restricted access to uploads in the /ultimatemember/
directory to logged in users only using an Apache (.htaccess
) Access Rule. However, this is not possible for the user database, since it need to be checked for non-logged in users in the log in process. To be clear, this question is on restricting access to user data base content, not user uploads (that I've fixed).
um_loggedin
shortcode and regain direct access, which makes no sense as I have no access to those things. What exactly is the concern here? Please be specific about what it is, a GET request to where/what?