Skip to content

Plugins: Distinguish a missing admin page from an access denial (#14060)#12591

Open
roshniahuja wants to merge 1 commit into
WordPress:trunkfrom
roshniahuja:14060-admin-page-not-found-message
Open

Plugins: Distinguish a missing admin page from an access denial (#14060)#12591
roshniahuja wants to merge 1 commit into
WordPress:trunkfrom
roshniahuja:14060-admin-page-not-found-message

Conversation

@roshniahuja

@roshniahuja roshniahuja commented Jul 19, 2026

Copy link
Copy Markdown

Description

Accessing the URL of a plugin admin page that is no longer registered previously
showed the misleading "Sorry, you are not allowed to access this page." message,
implying a permissions problem where none exists.

This introduces admin_page_exists(), which determines whether the requested page
is registered independently of the current user's capabilities. When the page does
not exist, wp_die() is now called with a clearer "The requested page does not
exist." message and a 404 status, and a new admin_page_not_found action fires,
mirroring the existing admin_page_access_denied action.
user_can_access_admin_page() reuses the new function so the registration check is
no longer duplicated.

Testing Instructions

  • Install and activate a plugin that includes a settings page.
  • Navigate to the plugin's settings page and copy the URL.
  • Deactivate the plugin.
  • Paste the copied URL into the browser's address bar and press Enter.
  • You should see "The requested page does not exist." (404) instead of "Sorry, you
    are not allowed to access this page."

Unit tests:
npm run test:php -- --filter admin_page_exists tests/phpunit/tests/admin/includesPlugin.php

Trac ticket: https://core.trac.wordpress.org/ticket/14060

Requesting the URL of a plugin admin page that is no longer registered
previously produced the misleading "Sorry, you are not allowed to access
this page." message, implying a capability problem where none exists.

Introduce `admin_page_exists()`, which reports whether the requested page
is registered independently of the current user's capabilities. When the
page does not exist, `wp_die()` is now called with a clearer "The requested
page does not exist." message and a 404 status, and a new
`admin_page_not_found` action fires, mirroring the existing
`admin_page_access_denied` action. `user_can_access_admin_page()` reuses the
new function so the registration check is no longer duplicated.

Fixes #14060.
@github-actions

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props roshniahuja14.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@github-actions

Copy link
Copy Markdown

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant