WordPress Multisite + bbPress breaks s2Member access restrictions on child sites

[raamdev]

Steps to reproduce this bug

1. On a WordPress Multisite Install (tested using sub-directories), install and Network Activate bbPress (tested with v2.5.4) and s2Member Pro (tested with v150203).
2. Create 2 Child Sites and on each child site, protect a post with Level 0 Access.
3. Create a user with Level 0 access on each Child Site
4. Login to Child Site 1 with the user who has Level 0 access and try to visit the protected post on Child Site 2.

Expected behavior

The expected behavior is for access to be denied, since this is a Child Site 1 user, not a Child Site 2 user, who is attempting to access the protected Child Site 2 post.

What actually happens

As long as bbPress is active, access to the protected Child Site 2 post is granted to the Child Site 1 user. If you disable bbPress and attempt to revisit he Child Site 2 post as the Child Site 1 user, access will be denied (expected behavior).

---

This appears to be a bug related to WP Multisite + s2Member Pro + bbPress.

---

Support threads referencing this issue

• https://websharks.zendesk.com/agent/tickets/4932

---

Possibly related to #321.

[raamdev]

Marking this high priority and adding it to the Next Release milestone because this issue affects security (access restrictions).

[jaswrks]

@raamdev Does your test site have COOKIEPATH or SITECOOKIEPATH defined in the /wp-config.php file?

[jaswrks]

Create 2 Child Sites and on each child site, protect a post with Level 0 Access.

So the issue is specifically with Level 0; i.e., the user is thought of as "logged in" on both sites, when in fact they should not be. Actually, with a Multisite Network this is configurable. Depending on COOKIEPATH and/or SITECOOKIEPATH (WordPress core constants), this behavior may change.

By default, a user is logged into all sites, and thus they have Level 0 access. To change this, we would need to alter the default WordPress behavior in order to address this bug report; i.e., we would need to alter the default cookie path used in a Multisite Network installation.

Referencing: https://github.com/WordPress/WordPress/blob/master/wp-includes/ms-default-constants.php#L47

These could be set to $current_blog->path, but other considerations need to made with respect to sub-domain installs and domain mapping plugins.

[raamdev]

Does your test site have COOKIEPATH or SITECOOKIEPATH defined in the /wp-config.php file?

No, it does not.

By default, a user is logged into all sites, and thus they have Level 0 access.

So, in an Multisite environment with s2Member Pro installed, a user who logs into a Child A with Level 0 access, automatically has Level 0 access to Child B, but they don't have Level 1+ access to Child B?

That seems really confusing and counterintuitive.

From a non-s2Member perspective, it makes sense: Users login to one site and appear logged into all sites in the network (so they can leave comments on various sites without logging in again, for example).

However, from an s2Member-perspective, where the intention is to restrict access to content, logging into one site and having access to Level 0 restricted content across any site, does not make sense.

Note: Behavior seems bbPress-specific

This behavior only occurs when bbPress is Network Activated. If I disable bbPress, the expected behavior (i.e., a Level 0 user logged into Child A cannot access Level 0 content on Child B), so that tells me there's more going on here than what you described.

[jaswrks]

If I disable bbPress, the expected behavior (i.e., a Level 0 user logged into Child A cannot access Level 0 content on Child B), so that tells me there's more going on here than what you described.

I see. Yep! The wp_capabilities meta key must also be present on each site; i.e., they must be a member of each site—that is true even in a default Multisite Network installation. This has not been an issue in the past, so I will do more digging when it comes to bbPress.

[jaswrks]

Referencing: https://github.com/wp-plugins/bbpress/blob/master/includes/users/capabilities.php#L242

[jaswrks]

This has been resolved in the latest dev branch. Raam, if you can run a quick test to confirm I'd appreciate it :-) Please use: https://github.com/websharks/s2member/tree/release/150223

[jaswrks]

Next Release Changelog:

• (s2Member/s2Member) bbPress Bug Fix: This release resolves a security issue when running a Multisite Network with bbPress + s2Member. Level 0 access was being granted by the bbPress plugin across all sites in a network. That behavior is fine for bbPress, but is unexpected when s2Member is running in a Network environment. See also: this GitHub issue if you'd like additional details.