Some friends of mine (Joe Ugoretz and Jim Groom) were chatting on Twitter yesterday about how Userthemes, the WPMU/MS plugin they rely on to allow user customizations of copied system themes, had broken with WordPress 3.0. I decided to take a look at it. After digging a little, I found the immediate cause, as well as a workaround.
Please note that this workaround is very much a hack. It shouldn’t cause any security issues (see explanation below), but it will break the next time you upgrade WP.
Joe’s problem was that the plugin was only working for Super Admins. Administrators of single Sites could not copy new Userthemes, and they were redirected to the dreaded wp-admin/?c=1 when they tried to access the Edit Userthemes panel on the Dashboard. I figured it was a problem with permissions, and it was: all of those functions are triggered only for those users with the capability edit_themes, but for some reason only Super Admins, and not Administrators, were showing up as having that ability. (The weird thing – when I did a var_dump of WP Roles, I saw that Administrator *did* have edit_themes.) Maybe there’s some setting in WPMS that allows users to edit themes, but I couldn’t see it.
So the solution is to change the edit_themes check to something else. switch_themes seemed like an obvious choice to me, since anyone with the ability to switch themes on a given blog would also have had the ability to edit themes on that same blog. So there shouldn’t be a security problem – only blog admins should have the ability to make userthemes.
You’ll need to modify the plugin, as well as a few lines in the WordPress core.
- Back up. I’m not responsible for anything that goes wrong!
- Open the userthemes.php file. (I’d link to it, but I can’t find it anywhere on the web. When I’m at a better internet connection, maybe I’ll upload a version for you to edit. Maybe someone out there has a copy to share.) Search for all instances of ‘edit_themes’ and replace with ‘switch_themes’.
- From your WP root directory, open wp-admin/theme-editor.php. On line 12, change ‘edit_themes’ to ‘switch_themes’.
- From your WP root directory, open wp-admin/menu.php. On line 173, change ‘edit_themes’ to ‘switch_themes’.
A great victory, ugly or not! Thanks so much for this, and I think it’s beautiful.
You can use the map_meta_cap filter to manage the theme privilege instead of hacking WP.
Looks promising… but it didn’t do anything for me… yet. I mean, I did step 3 and 4 (couldn’t find userthemes.php anywhere in my install). So it’s still not working. I really think that my issue is that somehow, wordpress isn’t installed for any of my users (the main WPMU is working but not the added install for all my users). I really think I’m going crazy!
Pingback: Prestidigitation » Alkivia Chameleon Theme in WordPress 3.0 with Multi-Site
Pingback: UMW Blogs Upgraded to WP 3.0 (a play-by-play) « bavatuesdays