WordPress MU

I'm running WPMU 2.7.1 and yesterday evening I noticed something weird happening with new users. For some reason, these users are being added to the "Post Author" box in the Add New Post section of the site (whether they sign up for a blog or not). So if the site admin is posting, she can select from their names as the author of her posts.

Not sure how they're getting in there, because they are registered only as subscribers to the blog with no posting functions. I don't want their security compromised so I'd like to get them out of that list.

Anyone know how this is happening and how to stop it?

That is a normal perk for the SiteAdmin (see function get_editable_user_ids from wp-admin/includes/user.php).

So I'll recommend a couple choices.

The poor choice, is to remove the subscribers from the main blog. The subscribers have to be somewhere to see their profile when logged in case they are not a user of any other blog sitewide. The side effect is that SiteAdmins can play havoc with post authors, if they like.

The better choice is to never use the SiteAdmin account for day to day posting and blogging stuff. Have a normal account for posting and the problem doesn't exist, normal users get a normal looking dropdown user switcher.

My choice: If your SiteAdmins have to post to the main blog AND never user the author dropdown switcher anyway, then remove the edit author metabox:
remove_meta_box('authordiv', 'post', 'normal');

I have a plugin to do that, too, http://wpmudevorg.wordpress.com/project/meta-boxes

Best solution: Upgrade to the bleeding edge WPMU2.7.1 and move all your "subscribers" to a non-posting blog. WPMU 2.7.1 has code to set up a "Dashboard Blog" so non-blog users get at least their dashboard and profile - and the move happens automagically, too at the SiteAdmin-->Options page. Now the blogs you post to as SiteAdmin won't ever have every Tom Dick and Harry to choose from.

Now some "what ifs?" What if a normal user adds towsands and towsands of authors/editors/admins to their blog and the same slow down happens on their edit post page?

@dsader, thank you so much for your help on this. I'm using 2.7.1, so I may just migrate the users--or just get rid of the metabox with your plugin.

I appreciate your provision of so many options. Now I've just got to go and implement one.

Much appreciated.

I will note this problem
thank you
_____________________________________________
laptop gia re