From 708cd13d777a0370c51c4751585fe523d1267208 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Thu, 3 Sep 2015 08:53:23 +0000
Subject: [PATCH] Provide more helpful feedback than just "Cheatin' uh?" for
 permission errors in `wp-admin/users.php`.

props ericlewis, kraftbj, lukecarbis, mrmist.
fixes #33679. see #14530.

git-svn-id: https://develop.svn.wordpress.org/trunk@33885 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/users.php                     | 18 ++++++++++++++----
 src/wp-includes/class-wp-xmlrpc-server.php |  2 +-
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/wp-admin/users.php b/src/wp-admin/users.php
index df7648b777..982e1ef65f 100644
--- a/src/wp-admin/users.php
+++ b/src/wp-admin/users.php
@@ -9,8 +9,13 @@
 /** WordPress Administration Bootstrap */
 require_once( dirname( __FILE__ ) . '/admin.php' );
 
-if ( ! current_user_can( 'list_users' ) )
-	wp_die( __( 'Cheatin&#8217; uh?' ), 403 );
+if ( ! current_user_can( 'list_users' ) ) {
+	wp_die(
+		'<h1>' . __( 'Cheatin&#8217; uh?' ) . '</h1>' .
+		'<p>' . __( 'You are not allowed to browse users.' ) . '</p>',
+		403
+	);
+}
 
 $wp_list_table = _get_list_table('WP_Users_List_Table');
 $pagenum = $wp_list_table->get_pagenum();
@@ -127,8 +132,13 @@ case 'promote':
 		}
 
 		// If the user doesn't already belong to the blog, bail.
-		if ( is_multisite() && !is_user_member_of_blog( $id ) )
-			wp_die( __( 'Cheatin&#8217; uh?' ), 403 );
+		if ( is_multisite() && !is_user_member_of_blog( $id ) ) {
+			wp_die(
+				'<h1>' . __( 'Cheatin&#8217; uh?' ) . '</h1>' .
+				'<p>' . __( 'One of the selected users in not a member of this site.' ) . '</p>',
+				403
+			);
+		}
 
 		$user = get_userdata( $id );
 		$user->set_role($_REQUEST['new_role']);
diff --git a/src/wp-includes/class-wp-xmlrpc-server.php b/src/wp-includes/class-wp-xmlrpc-server.php
index 7108ff0a7b..b74374e538 100644
--- a/src/wp-includes/class-wp-xmlrpc-server.php
+++ b/src/wp-includes/class-wp-xmlrpc-server.php
@@ -2411,7 +2411,7 @@ class wp_xmlrpc_server extends IXR_Server {
 		do_action( 'xmlrpc_call', 'wp.getUsers' );
 
 		if ( ! current_user_can( 'list_users' ) )
-			return new IXR_Error( 401, __( 'Sorry, you cannot list users.' ) );
+			return new IXR_Error( 401, __( 'You are not allowed to browse users.' ) );
 
 		$query = array( 'fields' => 'all_with_meta' );