0

I am setting up a WordPress with a user system. User information (names, profile picture) of all users should be private, and only accessable when logged in.

The "Ultimate Member" plugin provides a shortcode, which then displays information about a user:
[ultimatemember form_id="731"]
To hide this information from non logged in users, they propose to wrap it as follows:
[um_loggedin][ultimatemember form_id="731"][/um_loggedin]
Now the user information is only visible when logged in.

But, am I mistaken, or would any direct request to the user data (e.g. what is under the hood of the first shortcode) base still return private information? For example, when you have the URL, the profile picture could still be accessed at
https://www.example.com/wp-content/uploads/ultimatemember/3/profile_photo-190x190.jpg

From what I understand, the only type of real security here is security through obscurity, which is no security at all. I must be mistaken; how does this work?

I have since restricted access to uploads in the /ultimatemember/ directory to logged in users only using an Apache (.htaccess) Access Rule. However, this is not possible for the user database, since it need to be checked for non-logged in users in the log in process. To be clear, this question is on restricting access to user data base content, not user uploads (that I've fixed).

Improve this question
6
  • 1
    I don't understand the question. How is somebody supposed to be able to "directly access" user data in the database?
    – Jacob Peattie
    Jun 21 at 10:06
  • Sorry, my experience implementing PHP and HTML with SQL databases is limited, but with a GET request? Or for example, whatever is under the hood of t Ultimatemember form that was able to request the data.
    – M.G.Poirot
    Jun 21 at 10:52
  • if we ignore the assets that the plugin you chose handles, there's a logical leap that makes no sense for grabbing the data, you're implying that I as a visitor can undo the um_loggedin shortcode and regain direct access, which makes no sense as I have no access to those things. What exactly is the concern here? Please be specific about what it is, a GET request to where/what?
    – Tom J Nowell ♦
    Jun 21 at 10:52
  • 1
    More importantly, have you asked this of ultimate members? 3rd party plugins can change things enormously and any answer here can only be written with general WP knowledge, as a 3rd party plugin ultimate members is offtopic here and not in this stacks scope so you can't ask about that particular plugin
    – Tom J Nowell ♦
    Jun 21 at 10:54
  • Hi, I am sorry for my limited understanding of PHP/SQL, and my question is really meant to be generic (not ultimate member specific). But as I understand it: - A form requests data from the data base using a HTTP request - I saw that the ultimatemember form did not need a login status to perform this request - thus, I was afraid that no log in status would be required to perform requests to the data base.
    – M.G.Poirot
    Jun 21 at 10:58

1 Answer 1

Reset to default
1

I guess you are not familiar with WordPress API. WordPress uses nonces to keep track of logged in users and authorized requests. Relatively new feature is also App authentication, which is under the hood basic authentication. However, while WordPress IS secure (nonces are sent in headers and have expiry time), specific plugin you are using may have this implemented correctly or incorrectly, and your security will depend on this plugin (as well as others) you are using. There are online sources to check on security of plugins, see if yours is listed.

There is another consideration - every user who has enough rights to change content may remove your "security shortcode". So to account for that possibility, for example, only admin or specific personel should be allowed to edit these posts, which you have to develop yourself, or search plugin for that.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.