Ultimate Facebook - Network Admin App API Settings (for Multisite)

Hello All,

I would like to enable the plugin network wide, but not display the API security strings to site admins.

I do believe they would need to still see the plugin to enable autoposts, post AS wall (vs user), import settings etc.

However, I do not beieve they need their own API to access their own clubs calendar (assuming they granted permissions AND are logged in)?

Would this be difficult to modify? Perhaps instead of variables for API< hard code, then comment out the interface to set?

  • in-mn
    • The Crimson Coder

    From my understanding, the walls posting is contingent on the permissions allowed by admins.

    However i ran into domain mapping, forgetting API only allows 1 dev.

    So maybe the restriction may be beneficial if not domain mapping. Yet I cant see an easy way to deterimine this.

  • Philip John
    • DEV MAN’s Apprentice

    The permissions are granted to allow access to the admin user's Facebook account.

    If a sub-site admin wants to autopost to their Facebook profile or page, they will have to grant extended permissions to their account.

    Yes, if you're using domain mapping you will need a separate app for each site.

    Phil

  • in-mn
    • The Crimson Coder

    yeah - i think i will leave this unconfigured on the network or perhaps save it for a supporter as i have no interest helping the dummies set it up (no matter how easy it is).

    I had hoped to leave my API in, and new blog templates to copy those settings to enable it on all subdomain installs. I may just yet, as I was concerned about giving the api access keys to my users.

    I guess I am not familiar with best practices in that regard. I assume most are too ignorant to use my keys poorly causing issues for me, but you never know.

    What about this idea.

    Restrict API Access key view/edit to Super Admin only?

  • Philip John
    • DEV MAN’s Apprentice

    You could, that would still render the plugin useless to sub-sites using domain mapping though.

    If you want to use it on the main site but aren't convinced your users will be able to figure it out, just activate it on the main site only instead.

    Phil

  • in-mn
    • The Crimson Coder

    I believe the app doesnt need API for login/comments, so what I may just do is tell them to use their own shortcodes for events, and use new blog templates off a blank configuration of it.

    Is it bad if i let people see the secret key of the app? secrets should be secret, but whatcha think personally?

  • in-mn
    • The Crimson Coder

    Fb permissions are strange beast. They can use my keys, but how the wall settings are saved is only visible/setable by that user. But all in all, this was a bad idea. I had hoped to avoid need of multiple api's keys for each mutlisite to simplify how it worked, but no need.

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.