id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
15122	current_user_can_for_blog() doesn't use map_meta_cap for multisite user admins	jamescollins		"[12796] introduced a new current_user_can_for_blog() function, which was based on how the existing current_user_can() function was implemented.

This included this check:

{{{
if( is_multisite() && is_super_admin() ) 
    return true;
}}}


Then in [13270]/#12109, the current_user_can() function was modified so that map_meta_cap is always used for multisite user admins.

However this change didn't include the necessary change to the current_user_can_for_blog() function as well.

This means that currently the current_user_can_for_blog() will always return true for multisite user admins, without map_meta_cap ever being used.

Patch attached."	defect (bug)	closed	normal	3.0.2	Role/Capability	3.0	normal	fixed