How to use it
- In Bricks > Kiln, under Admin & agency, turn on Admin: hide the license screen. Click Save modules. The module is off by default.
- Open Settings under the module. Under Administrators who see the license, tick the administrators who should keep the page. If you tick nobody, every administrator keeps it.
- Click Save modules.
If you tick others but not yourself, Kiln adds you. Multisite super admins always keep access.
Chosen users who are deleted, or who lose the manage_options capability, drop out of the list. If that empties
the list, every administrator keeps the page again.
Where it appears in Bricks
An administrator who is not chosen sees:
- No Bricks > License entry in the menu.
- The message "The license page is restricted on this site. Ask the administrator who manages the license." with a 403 response, if they open the page's address.
- None of Bricks' license notices.
- The error "The license is managed by another administrator." if a license action is sent to the server. The actions are activate, deactivate, delete the stored key and re-check.
- The module's row in Bricks > Kiln, with a disabled checkbox and the note "Managed by another administrator." They cannot turn the module off or change who is chosen.
- The same lock on the Admin: white label row: the chosen administrators also own the white-label settings.
How it works with Bricks
Bricks shows its license page (with the key masked) and its license notices to every administrator. Kiln removes the menu entry, blocks the page, drops the notices that Bricks registers on its license object, and answers Bricks' license requests before Bricks does, for administrators who are not chosen.
Kiln also fixes a leak in Bricks 2.4.3. When a remote-templates request fails, Bricks returns the request URL, and
that URL carries the full license key. Anyone who can use the builder can read it. Kiln handles that request itself,
with the same nonce check and the same data, minus the request_url entry. This applies to everyone while the
module is on, not only to administrators who are not chosen.
What it is not
This is not access control. It hides the license screen from administrators you did not choose. Any administrator can still read the site's options or install code, so the key is not secret from them.
Limits
- Kiln removes only the notices Bricks registers on its own license object and leaves other notices alone.
- The leak fix covers the remote-templates request. It does not change anything else in Bricks.
Settings
Administrators who see the license: a list of the site's administrators (up to 500, sorted by display name), each shown as display name and login.
Requirements
Bricks 2.4 or newer.