Update check: hide or show read-only the setting on multisite sub-sites #22

New issue

Closed

opened 2026-10-16 14:39:58 -07:00 by eric · 0 comments

eric commented

2026-10-16 14:39:58 -07:00

Owner

Type: UX bug in the new update check (#19). Found by security audit run 4 (commit 77fcd83). Not a security issue.

What happens

On multisite, UpdateChecker::enabled() (src/Update/UpdateChecker.php:45-50) reads only the main site's multi_domain_redux_update_check option. Plugin updates are network-wide, so that part is correct.

The settings page, however, renders and saves the current blog's value. SettingsRenderer::render() (src/Admin/SettingsRenderer.php:33) uses get_option(), and the option is registered on every site (src/Admin/SettingsPage.php:55-64). Two things follow:

A super admin who ticks the box on a sub-site's settings page changes nothing.
A sub-site's page can show "unchecked" while update checks are actually on, or the reverse.

Suggested fix

Do one of these:

Render the field only when ! is_multisite() || is_main_site(), and add a short note on sub-sites ("Update checks are configured on the main site").
Or render the main site's value (get_blog_option( get_main_site_id(), ... )) read-only on sub-sites, and skip registering the option there.

Add a test that, on multisite, the sub-site settings page does not offer an editable update-check field.

**Type:** UX bug in the new update check (#19). Found by security audit run 4 (commit `77fcd83`). Not a security issue. ## What happens On multisite, `UpdateChecker::enabled()` (`src/Update/UpdateChecker.php:45-50`) reads only the **main site's** `multi_domain_redux_update_check` option. Plugin updates are network-wide, so that part is correct. The settings page, however, renders and saves the **current blog's** value. `SettingsRenderer::render()` (`src/Admin/SettingsRenderer.php:33`) uses `get_option()`, and the option is registered on every site (`src/Admin/SettingsPage.php:55-64`). Two things follow: - A super admin who ticks the box on a sub-site's settings page changes nothing. - A sub-site's page can show "unchecked" while update checks are actually on, or the reverse. ## Suggested fix Do one of these: - Render the field only when `! is_multisite() || is_main_site()`, and add a short note on sub-sites ("Update checks are configured on the main site"). - Or render the main site's value (`get_blog_option( get_main_site_id(), ... )`) read-only on sub-sites, and skip registering the option there. Add a test that, on multisite, the sub-site settings page does not offer an editable update-check field.

eric added the

enhancement

label

2026-10-16 14:39:58 -07:00

eric referenced this issue from a commit

2026-10-16 15:31:24 -07:00

fix: show the update-check setting read-only on multisite sub-sites

eric closed this issue

2026-10-16 15:31:24 -07:00