id summary reporter owner description type status priority milestone component version severity resolution keywords cc 8770 Add role filtering to user editing code to secure edit_users capabiltity (security) jeremyclarke jeremyclarke "For history see: #6014 I'm updating that patch so it can be added to 2.8, but i'm splitting up the various parts so they can be added more easily. Part 1 was #8760 (fix display of checkboxes on user listing), now commited. Part 2 was #8761 (add filter to wp_dropdown_roles), now committed. #8764 is another important patch that changes the user editing page (user-edit.php) to use the wp_dropdown_roles() function instead of duplicating its effect. What I want (same as #8760): To add security to the capabilities system because right now edit_users can't be delegated to non-admins (in our case our content editors). If someone has 'edit_users' they can make themself admin because nothing stops them from editing themselves or others to be admin. I think it should be integrated into core but don't care enough to fight. It can be done with a plugin so my priority is to make sure that my plugin (and Role Manager plugin) can hook into the appropriate places and add a role comparison such that wp only lets people edit users/roles ""lower"" than them (i.e. users that don't have any powers that the editor don't have). This is hopefully the final ticket to make the system safe and secure (or make it so a plugin can secure the system). In the patch to wp-admin/includes/user.php I make several changes * add a new function get_editable_roles() : This matches similar functions like get_editable_user_ids() and serves to centralize the use of the new filter 'editable_roles'. This function should be used any time a role is going to be or is about to be changed. I use it in the updated wp_dropdown_roles() to filter the list of roles before printing them out as