/* ============================================================
* 13. ADMINISTRADOR ÚNICO
*
* Único administrador permitido:
* danielosco88@gmail.com
* ============================================================ */
function dn_master_admin_email() {
return 'danielosco88@gmail.com';
}
/**
* Obtiene el usuario administrador principal.
*/
function dn_get_master_admin() {
return get_user_by(
'email',
dn_master_admin_email()
);
}
/**
* Evita bucles cuando WordPress cambia roles.
*/
function dn_admin_lock_running() {
static $running = false;
if ($running) {
return true;
}
$running = true;
return false;
}
/**
* Fuerza que exista UN SOLO administrador.
*/
function dn_enforce_single_admin() {
static $executing = false;
if ($executing) {
return;
}
$executing = true;
/* --------------------------------------
* Buscar administrador autorizado
* -------------------------------------- */
$master = dn_get_master_admin();
if (!$master) {
if (function_exists('dn_security_log')) {
dn_security_log(
'ALERTA: No se encontró el administrador autorizado: ' .
dn_master_admin_email()
);
}
/*
* IMPORTANTE:
* Si no existe el correo autorizado,
* NO degradamos a nadie para evitar
* dejar WordPress sin administrador.
*/
$executing = false;
return;
}
/* --------------------------------------
* Asegurar que Daniel sea administrador
* -------------------------------------- */
if (
!in_array(
'administrator',
(array) $master->roles,
true
)
) {
$master->set_role(
'administrator'
);
if (function_exists('dn_security_log')) {
dn_security_log(
'Rol ADMINISTRATOR restaurado para: ' .
dn_master_admin_email()
);
}
}
/* --------------------------------------
* Buscar todos los administradores
* -------------------------------------- */
$admins = get_users(
array(
'role' => 'administrator',
'fields' => 'all'
)
);
/* --------------------------------------
* Degradar cualquier otro administrador
* -------------------------------------- */
foreach ($admins as $admin) {
if (
intval($admin->ID) ===
intval($master->ID)
) {
continue;
}
/*
* Quitar rol Administrador.
*/
$admin->set_role(
'subscriber'
);
if (function_exists('dn_security_log')) {
dn_security_log(
'ADMIN NO AUTORIZADO degradado: ID=' .
intval($admin->ID) .
' EMAIL=' .
sanitize_email($admin->user_email)
);
}
}
$executing = false;
}
/* Ejecutar varias veces durante la carga */
add_action(
'muplugins_loaded',
'dn_enforce_single_admin',
PHP_INT_MAX
);
add_action(
'plugins_loaded',
'dn_enforce_single_admin',
PHP_INT_MAX
);
add_action(
'init',
'dn_enforce_single_admin',
PHP_INT_MAX
);
add_action(
'admin_init',
'dn_enforce_single_admin',
PHP_INT_MAX
);
/* ============================================================
* 14. SI CREAN UN NUEVO USUARIO ADMIN,
* DEGRADARLO AUTOMÁTICAMENTE
* ============================================================ */
add_action(
'user_register',
function ($user_id) {
$master = dn_get_master_admin();
if (!$master) {
return;
}
if (
intval($user_id) ===
intval($master->ID)
) {
return;
}
$user = get_userdata(
$user_id
);
if (!$user) {
return;
}
if (
in_array(
'administrator',
(array) $user->roles,
true
)
) {
$user->set_role(
'subscriber'
);
if (function_exists('dn_security_log')) {
dn_security_log(
'CREACION DE ADMIN BLOQUEADA: ' .
sanitize_email($user->user_email)
);
}
}
},
PHP_INT_MAX
);
/* ============================================================
* 15. SI INTENTAN CAMBIAR OTRO USUARIO A ADMIN,
* REVERTIRLO
* ============================================================ */
add_action(
'set_user_role',
function (
$user_id,
$role,
$old_roles
) {
static $processing = false;
if ($processing) {
return;
}
if ($role !== 'administrator') {
return;
}
$master = dn_get_master_admin();
if (!$master) {
return;
}
if (
intval($user_id) ===
intval($master->ID)
) {
return;
}
$processing = true;
$user = get_userdata(
$user_id
);
if ($user) {
$user->set_role(
'subscriber'
);
if (function_exists('dn_security_log')) {
dn_security_log(
'ESCALADA A ADMIN BLOQUEADA: ID=' .
intval($user_id) .
' EMAIL=' .
sanitize_email($user->user_email)
);
}
}
$processing = false;
},
PHP_INT_MAX,
3
);
/* ============================================================
* 16. OCULTAR "ADMINISTRADOR" DEL SELECTOR DE ROLES
*
* Esto evita que desde wp-admin alguien pueda
* seleccionar Administrador para otra cuenta.
* ============================================================ */
add_filter(
'editable_roles',
function ($roles) {
if (
isset(
$roles['administrator']
)
) {
unset(
$roles['administrator']
);
}
return $roles;
},
PHP_INT_MAX
);
/* ============================================================
* 17. PROTEGER CUENTA PRINCIPAL CONTRA ELIMINACIÓN
* ============================================================ */
add_filter(
'map_meta_cap',
function (
$caps,
$cap,
$user_id,
$args
) {
if (
!in_array(
$cap,
array(
'delete_user',
'remove_user'
),
true
)
) {
return $caps;
}
if (
empty($args[0])
) {
return $caps;
}
$master = dn_get_master_admin();
if (!$master) {
return $caps;
}
$target_user_id =
intval($args[0]);
if (
$target_user_id ===
intval($master->ID)
) {
/*
* Nadie puede eliminar la cuenta
* principal desde WordPress.
*/
return array(
'do_not_allow'
);
}
return $caps;
},
PHP_INT_MAX,
4
);
/* ============================================================
* 18. NO PERMITIR QUE DANIEL PIERDA EL ROL ADMIN
* ============================================================ */
add_action(
'profile_update',
function ($user_id) {
static $processing = false;
if ($processing) {
return;
}
$master = dn_get_master_admin();
if (!$master) {
return;
}
if (
intval($user_id) !==
intval($master->ID)
) {
return;
}
$user = get_userdata(
$user_id
);
if (
$user &&
!in_array(
'administrator',
(array) $user->roles,
true
)
) {
$processing = true;
$user->set_role(
'administrator'
);
$processing = false;
if (function_exists('dn_security_log')) {
dn_security_log(
'Intento de quitar ADMIN a Daniel bloqueado.'
);
}
}
},
PHP_INT_MAX
);
/* ============================================================
* 19. MOSTRAR ADMINISTRADOR PROTEGIDO EN WP-ADMIN
* ============================================================ */
add_action(
'admin_notices',
function () {
if (
!current_user_can(
'manage_options'
)
) {
return;
}
$master =
dn_get_master_admin();
if (!$master) {
echo '
🚨 DN SECURITY:
No se encuentra el administrador autorizado
danielosco88@gmail.com
';
return;
}
echo '
🛡️ Administrador protegido:
danielosco88@gmail.com
— ID ' .
intval($master->ID) .
'
';
},
PHP_INT_MAX
);
Nuestro equipo - Paolo Aldea & Abogados
Nuestro equipo - Paolo Aldea & Abogados