vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-07-01 15:50:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Multisite: Handle capability check for removing oneself via map_meta_cap().

Browse Source 
Site administrators should not be able to remove themselves from a site. This moves the enforcement of this rule from `wp-admin/users.php` to `remove_user_from_blog()` via the `remove_user` capability, which furthermore allows us to get rid of two additional clauses and their `is_super_admin()` checks in `wp-admin/users.php`. A unit test for the new behavior has been added.

Fixes #39063. See #37616.


git-svn-id: https://develop.svn.wordpress.org/trunk@39588 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Felix Arntz
2016-12-12 21:41:44 +00:00
parent 87e6390895
commit 539b85406d
3 changed files with 24 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/wp-includes/capabilities.php
View File

@@ -32,7 +32,12 @@ function map_meta_cap( $cap, $user_id ) {
switch ( $cap ) {
case 'remove_user':
$caps[] = 'remove_users';
// In multisite the user must be a super admin to remove themselves.
if ( isset( $args[0] ) && $user_id == $args[0] && ! is_super_admin( $user_id ) ) {
$caps[] = 'do_not_allow';
} else {
$caps[] = 'remove_users';
}
break;
case 'promote_user':
case 'add_users':