vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-07-01 15:50:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Multisite: Handle capability check for removing oneself via map_meta_cap().

Browse Source 
Site administrators should not be able to remove themselves from a site. This moves the enforcement of this rule from `wp-admin/users.php` to `remove_user_from_blog()` via the `remove_user` capability, which furthermore allows us to get rid of two additional clauses and their `is_super_admin()` checks in `wp-admin/users.php`. A unit test for the new behavior has been added.

Fixes #39063. See #37616.


git-svn-id: https://develop.svn.wordpress.org/trunk@39588 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Felix Arntz
2016-12-12 21:41:44 +00:00
parent 87e6390895
commit 539b85406d
3 changed files with 24 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
tests/phpunit/tests/user/capabilities.php
View File

@@ -1757,4 +1757,21 @@ class Tests_User_Capabilities extends WP_UnitTestCase {
wp_set_current_user( self::$users['editor']->ID );
$this->assertFalse( current_user_can( 'add_user_meta', self::$users['subscriber']->ID, 'foo' ) );
}
/**
* @ticket 39063
*/
public function test_only_super_admins_can_remove_themselves_on_multisite() {
if ( ! is_multisite() ) {
$this->markTestSkipped( 'Test only runs in multisite.' );
}
$this->assertTrue( user_can( self::$super_admin->ID, 'remove_user', self::$super_admin->ID ) );
$this->assertFalse( user_can( self::$users['administrator']->ID, 'remove_user', self::$users['administrator']->ID ) );
$this->assertFalse( user_can( self::$users['editor']->ID, 'remove_user', self::$users['editor']->ID ) );
$this->assertFalse( user_can( self::$users['author']->ID, 'remove_user', self::$users['author']->ID ) );
$this->assertFalse( user_can( self::$users['contributor']->ID, 'remove_user', self::$users['contributor']->ID ) );
$this->assertFalse( user_can( self::$users['subscriber']->ID, 'remove_user', self::$users['subscriber']->ID ) );
}
}