Pierre-Lannoy / wp-sessions

Powerful sessions manager for WordPress with sessions limiter and full analytics reporting capabilities.
https://perfops.one/
GNU General Public License v3.0
18 stars 5 forks source link

Issue with multiple roles #2

Closed ShamiraO closed 3 years ago

ShamiraO commented 3 years ago

Hi, When a user have multiple roles, Sessions plugin only recognized the weakest role. If the new role allow more active sessions to an user the plugin will always choosed the smaller role unless it's an admin role. Even if the setting "cumulative privileges" is selected.

Is there a way to for Session to choose the strongest role ? maureen abonnée mauree-native wordpress

As you can see on the screenshots, the user "maureen" is an ''abonnée" and a "premium" user in wordpress role manager but in Session she is just an "abonnée" so she doesn't benefits from the ability to log multiple times.

Thank you in advance for your support. Shamira

Pierre-Lannoy commented 3 years ago

Hello Shamira! Thank you for reporting it. First of all, know the display of roles in "tools" section is just... a display. For now, it displays only the "main" role (i.e. the standard role) even if the user have many roles. And it's only a "display": in the sessions limiter engine, all roles are taken into account. It was initially done like that because the space to display role was limited. As it is no longer the case, all role will be displayed in the next version - thanks for this wonderful suggestion. 👍🏼 Now, the real issue: there's no "weakest" or "strongest" roles... There's just "different" roles. To allow me to see where the issue come from, could you attach to this issue:

Thank you

Example:

image
ShamiraO commented 3 years ago

Hi Pierre, Thank you for your quick response. Here is the screenshot for the user "maureen" session management. I am also adding the screenshot for an user who only have the "premium role".

maureen-sessions maureen premium

Pierre-Lannoy commented 3 years ago

Oups, seems something strange... Could you copy/paste the content of the "Session" section found in Site Info (in Tools > Site Health > Info)?

Thanks.

ShamiraO commented 3 years ago

Here it is...

[Site Option] version 2.4.0
[Site Option] use_cdn 0
[Site Option] download_favicons 0
[Site Option] script_in_footer 0
[Site Option] display_nag 0
[Site Option] analytics 1
[Site Option] forceip 1
[Site Option] followip 1
[Site Option] history 30
[Site Option] metrics 0
[Site Option] rolemode 0
[Site Option] zk_cycle 90
[Site Option] zk_tsize 20
[Site Option] zk_semaphore 300
[Site Option] buffer_limit 4000
[Site Option] bad_ip_message  
[Site Option] blocked_message  
[Site Option] administrator:limit none
[Site Option] administrator:maxip 0
[Site Option] administrator:method block
[Site Option] administrator:idle 0
[Site Option] administrator:block none
[Site Option] administrator:cookie-ttl 48
[Site Option] administrator:cookie-rttl 336
[Site Option] editor:limit none
[Site Option] editor:maxip 0
[Site Option] editor:method block
[Site Option] editor:idle 0
[Site Option] editor:block none
[Site Option] editor:cookie-ttl 48
[Site Option] editor:cookie-rttl 336
[Site Option] author:limit none
[Site Option] author:maxip 0
[Site Option] author:method block
[Site Option] author:idle 0
[Site Option] author:block none
[Site Option] author:cookie-ttl 48
[Site Option] author:cookie-rttl 336
[Site Option] contributor:limit none
[Site Option] contributor:maxip 0
[Site Option] contributor:method block
[Site Option] contributor:idle 0
[Site Option] contributor:block none
[Site Option] contributor:cookie-ttl 48
[Site Option] contributor:cookie-rttl 336
[Site Option] subscriber:limit user-1
[Site Option] subscriber:maxip 0
[Site Option] subscriber:method override
[Site Option] subscriber:idle 12
[Site Option] subscriber:block none
[Site Option] subscriber:cookie-ttl 48
[Site Option] subscriber:cookie-rttl 336
[Site Option] group_leader:limit none
[Site Option] group_leader:maxip 0
[Site Option] group_leader:method block
[Site Option] group_leader:idle 0
[Site Option] group_leader:block none
[Site Option] group_leader:cookie-ttl 48
[Site Option] group_leader:cookie-rttl 336
[Site Option] customer:limit user-1
[Site Option] customer:maxip 0
[Site Option] customer:method override
[Site Option] customer:idle 12
[Site Option] customer:block none
[Site Option] customer:cookie-ttl 48
[Site Option] customer:cookie-rttl 336
[Site Option] shop_manager:limit none
[Site Option] shop_manager:maxip 0
[Site Option] shop_manager:method block
[Site Option] shop_manager:idle 0
[Site Option] shop_manager:block none
[Site Option] shop_manager:cookie-ttl 48
[Site Option] shop_manager:cookie-rttl 336
[Site Option] test:limit none
[Site Option] test:maxip 4
[Site Option] test:method block
[Site Option] test:idle 0
[Site Option] test:block none
[Site Option] test:cookie-ttl 48
[Site Option] test:cookie-rttl 336
[Site Option] premium:limit user-4
[Site Option] premium:maxip 0
[Site Option] premium:method override
[Site Option] premium:idle 12
[Site Option] premium:block none
[Site Option] premium:cookie-ttl 48
[Site Option] premium:cookie-rttl 336
[Site Option] premium_2:limit none
[Site Option] premium_2:maxip 0
[Site Option] premium_2:method block
[Site Option] premium_2:idle 0
[Site Option] premium_2:block none
[Site Option] premium_2:cookie-ttl 48
[Site Option] premium_2:cookie-rttl 336
[Site Option] aba:limit user-2
[Site Option] aba:maxip 0
[Site Option] aba:method block
[Site Option] aba:idle 0
[Site Option] aba:block none
[Site Option] aba:cookie-ttl 48
[Site Option] aba:cookie-rttl 336
Pierre-Lannoy commented 3 years ago

Hi Shamira and thank you so much for this complete bug report that allowed me to reproduce the issue. 👍🏼

You're definitely right, there's something wrong with the cumulative privileges... In some edge cases, the limiter engine is not doing its job correctly (and you are in one of these edge cases).

I will make a patch in the coming days to fix this issue (will be 2.4.1 version).

Thanks you so much for detecting (and reporting) it... You rock!

Pierre-Lannoy commented 3 years ago

Version 2.4.1 is released. It fixes this issue. Don't hesitate to reopen this issue if this is not the case.

Thanks again for all.