# security hole in wordpress-admin-bar under WPMU?

I just tried logging into ucalgaryblogs.ca using a test user account, and was surprised to see a strange item in the admin bar at the top of the page:

I was curious, so I clicked it.

mwah? Those are site-admin items, being displayed to a non-admin user. I was actually able to click the "Admin Message" item to set that, even though the logged in user wasn't an admin. Scary. Luckily, nobody's noticed the extra menu yet - or if they have, they've behaved.

I poked around in the wordpress-admin-bar.php file to see if I could plug the hole. I have no idea if this is the right way, but I've added this bit:

} else {
if ($menu[0]['title'] === null) continue; // this is the line I added echo ' Has anyone else seen the extra menu? Could it have just been a freak thing only on my WPMU install, or is this a wide open potential security problem in the shipping wordpress-admin-bar.php file? It was written for non-WPMU WordPress, so it's quite possible it just doesn't grok the different types of users in WPMU. work code wordpress wpmu See Also private and group blogging with WPMU and WP-Sentry UCalgaryBlogs.ca Growth Testing WPMU 2.7 Is Flutter a CCK for WordPress? UCalgaryBlogs.ca Redesign   ← Previous Post Next Post → var disqus_config = function () { }; (function() { if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) { document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.'; return; } var d = document, s = d.createElement('script'); s.async = true; s.src = '//' + "darcy-norman-dot-net" + '.disqus.com/embed.js'; s.setAttribute('data-timestamp', +new Date()); (d.head || d.body).appendChild(s); })(); Please enable JavaScript to view the comments powered by Disqus. comments powered by Disqus       D'Arcy Norman • © 2002 - 2021 • D'Arcy Norman • Privacy Hugo v0.83.1 powered • Theme Beautiful Hugo adapted from Beautiful Jekyll hljs.initHighlightingOnLoad();$(document).ready(function() {\$("pre.chroma").css("padding","0");}); renderMathInElement(document.body);